diff --git a/ql/src/experimental/CWE-79/HTMLTemplateEscapingPassthrough.qhelp b/ql/src/experimental/CWE-79/HTMLTemplateEscapingPassthrough.qhelp index 57c04ca9121..ec406bdc198 100755 --- a/ql/src/experimental/CWE-79/HTMLTemplateEscapingPassthrough.qhelp +++ b/ql/src/experimental/CWE-79/HTMLTemplateEscapingPassthrough.qhelp @@ -4,7 +4,7 @@
In Go, the html/template package has a few special types
(HTML, HTMLAttr, JS, JSStr, CSS,
- Srcset, URL)
+ Srcset, and URL)
that allow values to be rendered as-is in the template, avoiding the escaping that all the other strings go
through.