mirror of
https://github.com/github/codeql.git
synced 2026-04-27 17:55:19 +02:00
JS: address doc-review comments
This commit is contained in:
@@ -10,13 +10,14 @@
|
||||
configurable through options provided by the clients of the
|
||||
plugin.
|
||||
|
||||
Clients, however, do not know the implementation details of the
|
||||
plugin, so it is important to document the capabilities of each
|
||||
option. Of particular importance is the documentation for the plugin
|
||||
options that the client is responsible for sanitizing.
|
||||
|
||||
Clients, however, do not know the implementation details
|
||||
of the plugin, so it is important to document the capabilities of each
|
||||
option. The documentation for the plugin options that the client is
|
||||
responsible for sanitizing is of particular importance.
|
||||
|
||||
Otherwise, the plugin may write user input (for example, a URL query
|
||||
parameter) to a web page without properly sanitizing the input first,
|
||||
parameter) to a web page without properly sanitizing it first,
|
||||
which allows for a cross-site scripting vulnerability in the client
|
||||
application through dynamic HTML construction.
|
||||
|
||||
@@ -36,8 +37,8 @@
|
||||
<example>
|
||||
<p>
|
||||
|
||||
The following example shows a jQuery plugin that selects a DOM
|
||||
element, and copies its text content another DOM element. The
|
||||
The following example shows a jQuery plugin that selects a
|
||||
DOM element, and copies its text content to another DOM element. The
|
||||
selection is performed by using the plugin option
|
||||
<code>sourceSelector</code> as a CSS selector.
|
||||
|
||||
@@ -47,7 +48,7 @@
|
||||
|
||||
<p>
|
||||
|
||||
This is however not a safe plugin, since the call to
|
||||
This is, however, not a safe plugin, since the call to
|
||||
<code>jQuery</code> interprets <code>sourceSelector</code> as HTML if
|
||||
it is a string that starts with <code><</code>.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user