hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update javascript/ql/src/Security/CWE-094/ExpressionInjection.qhelp

Browse Source 
Co-authored-by: Asger F <asgerf@github.com>
This commit is contained in:
Jaroslav Lobačevski
2023-05-09 12:23:52 +02:00
committed by GitHub
parent 1ad23c5366
commit 5aa71352dc
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
javascript/ql/src/Security/CWE-094/ExpressionInjection.qhelp
View File

@@ -21,7 +21,7 @@
The best practice to avoid code injection vulnerabilities
in GitHub workflows is to set the untrusted input value of the expression
to an intermediate environment variable and then use the environment variable
using the native syntax of the shell/script interpreter (i.e. <b>NOT</b> the <i>${{ env.VAR }}</i>).
using the native syntax of the shell/script interpreter (that is, not <i>${{ env.VAR }}</i>).
</p>
<p>
It is also recommended to limit the permissions of any tokens used