Fixed query help formatting issues

javascript/ql/src/Security/CWE-693/InsecureHelmet.qhelp

@@ -5,12 +5,14 @@
             <a href="https://helmetjs.github.io/">Helmet</a> is a collection of middleware functions for securing Express apps. It sets various HTTP headers to guard against common web vulnerabilities.
 
             This query detects Helmet misconfigurations that can lead to security vulnerabilities, specifically:
+        </p>
 
-            <ul>
-                <li>Disabling frame protection</li>
-                <li>Disabling Content Security Policy</li>
-            </ul>
+        <ul>
+            <li>Disabling frame protection</li>
+            <li>Disabling Content Security Policy</li>
+        </ul>
 
+        <p>
             Content Security Policy (CSP) helps spot and prevent injection attacks such as Cross-Site Scripting (XSS).
 
             Removing frame protections exposes an application to attacks such as clickjacking, where an attacker can trick a user into clicking on a button or link on a targeted page when they intended to click on the page carrying out the attack.
@@ -19,53 +21,55 @@
     <recommendation>
         <p>
             To help mitigate these vulnerabilities, ensure that the following Helmet functions are not disabled, and are configured appropriately to your application:
-            <ul>
-                <li><code>frameguard</code></li>
-                <li><code>contentSecurityPolicy</code></li>
-            </ul>
         </p>
+
+        <ul>
+            <li><code>frameguard</code></li>
+            <li><code>contentSecurityPolicy</code></li>
+        </ul>
     </recommendation>
     <example>
         <p>
             The following code snippet demonstrates Helmet configured in an insecure manner:
-            <code class="language-javascript">
-                const helmet = require('helmet');
-                app.use(helmet({
-                    frameguard: false,
-                    contentSecurityPolicy: false
-                }));
-            </code>
         </p>
+
+        <pre>
+            const helmet = require('helmet');
+            app.use(helmet({
+                frameguard: false,
+                contentSecurityPolicy: false
+            }));
+        </pre>
+
         <p>
             In this example, the defaults are used, which enables frame protection and a default Content Security Policy.
-
-            <code class="language-javascript">
-                app.use(helmet());
-            </code>
-
-            You can also enable a custom Content Security Policy by passing an object to the <code>contentSecurityPolicy</code> key. For example, taken from the <a href="https://helmetjs.github.io/#content-security-policy">Helmet docs:
-
-            <code class="language-javascript">
-                app.use(
-                    helmet({
-                        contentSecurityPolicy: {
-                            directives: {
-                                "script-src": ["'self'", "example.com"],
-                                "style-src": null,
-                            },
-                        },
-                    })
-                );
-            <code>
-        <p>
-            
         </p>
+
+        <pre>
+            app.use(helmet());
+        </pre>
+
+        <p>
+            You can also enable a custom Content Security Policy by passing an object to the <code>contentSecurityPolicy</code> key. For example, taken from the <a href="https://helmetjs.github.io/#content-security-policy">Helmet docs</a>:
+        </p>
+
+        <pre>
+            app.use(
+                helmet({
+                    contentSecurityPolicy: {
+                        directives: {
+                            "script-src": ["'self'", "example.com"],
+                            "style-src": null,
+                        },
+                    },
+                })
+            );
+        </pre>
+
     </example>
     <references>
-        <ul>
-            <li>
-                <a href="https://helmetjs.github.io/">helmet.js website</a>
-            </li>
-        </ul>
+        <li>
+            <a href="https://helmetjs.github.io/">helmet.js website</a>
+        </li>
     </references>
 </qhelp>