hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-22 19:56:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

JavaScript: Fix mixed tabs/spaces in qhelp.

Browse Source
This commit is contained in:
Max Schaefer
2018-11-07 07:40:51 +00:00
parent b130335adb
commit 5ffe45a80b
2 changed files with 64 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
javascript/ql/src/Electron/EnablingNodeIntegration.qhelp
View File

@@ -6,14 +6,14 @@
<overview>
<p>
Enabling Node.js integration in Electron web content renderers
(<code>BrowserWindow</code>, <code>BrowserView</code> and
<code>webview</code>) can result in remote native code execution
attacks.
Enabling Node.js integration in Electron web content renderers
(<code>BrowserWindow</code>, <code>BrowserView</code> and
<code>webview</code>) can result in remote native code execution
attacks.
The attack is realized when the renderer uses content from an
untrusted remote web site or a trusted site with a cross site
scripting vulnerability.
The attack is realized when the renderer uses content from an
untrusted remote web site or a trusted site with a cross site
scripting vulnerability.
</p>
</overview>
@@ -21,18 +21,18 @@
<recommendation>
<p>
Node.js integration should be disabled when loading remote web
sites. Always set <code>nodeIntegration</code> preference
to <code>false</code> before loading remote web sites, and only enable
it for whitelisted sites.
Node.js integration should be disabled when loading remote web
sites. Always set <code>nodeIntegration</code> preference
to <code>false</code> before loading remote web sites, and only enable
it for whitelisted sites.
</p>
<p>
Note that the <code>nodeIntegration</code> property is enabled
by default in Electron and needs to be set to <code>false</code>
explicitly.
Note that the <code>nodeIntegration</code> property is enabled
by default in Electron and needs to be set to <code>false</code>
explicitly.
</p>
</recommendation>
@@ -41,9 +41,9 @@
<p>
The following examples shows insecure and secure uses of
<code>BrowserWindow</code> and <code>BrowserView</code> when loading
remote web sites:
The following examples shows insecure and secure uses of
<code>BrowserWindow</code> and <code>BrowserView</code> when loading
remote web sites:
</p>