hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 02:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #10408 from giper45/patch-1

Browse Source 
Updated vulnerable XSS.java version
This commit is contained in:
Tony Torralba
2022-09-13 17:50:47 +02:00
committed by GitHub
parent af25cf8be2 ac46a38b9d
commit 4708052741
2 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
java/ql/src/Security/CWE/CWE-079/XSS.java
View File

@@ -1,8 +1,9 @@
public class XSS extends HttpServlet {
protected void doGet(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
// BAD: a request parameter is written directly to an error response page
response.sendError(HttpServletResponse.SC_NOT_FOUND,
// BAD: a request parameter is written directly to the Servlet response stream
response.getWriter().print(
"The page \"" + request.getParameter("page") + "\" was not found.");
}
}

2
java/ql/src/Security/CWE/CWE-079/XSS.qhelp
View File

@@ -18,7 +18,7 @@ reference.</p>
</recommendation>
<example>
<p>The following example shows the page parameter being written directly to the server error page,
<p>The following example shows the <code>page</code> parameter being written directly to the page,
leaving the website vulnerable to cross-site scripting.</p>
<sample src="XSS.java" />