hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 12:45:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

Apply suggestions from doc review

Browse Source 
Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com>
This commit is contained in:
Erik Krogh Kristensen
2020-06-18 16:38:52 +02:00
committed by GitHub
parent 73f26956a6
commit 9ba2c98ec0
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
javascript/ql/src/Security/CWE-200/PrivateFileExposure.qhelp
View File

@@ -7,10 +7,10 @@
<p>
Libraries like <code>express</code> provide easy methods for serving entire
directories of static files from a web server.
However, using these can sometimes lead to accidential information exposure.
However, using these can sometimes lead to accidental information exposure.
If for example the <code>node_modules</code> folder is served, then an attacker
can access the <code>_where</code> field from a <code>package.json</code> file,
which gives the attacker access to the absolute path of the file.
which gives access to the absolute path of the file.
</p>
</overview>
@@ -22,13 +22,13 @@
<example>
<p>
In the example below all the files from the <code>node_modules</code> are served.
In the example below, all the files from the <code>node_modules</code> are served.
This allows clients easy access to all files inside that folder, but also allows
access to potentially private information inside <code>package.json</code> files.
</p>
<sample src="examples/PrivateFileExposure.js"/>
<p>
The issue has been fixed in the below by only serving specific folders within the
The issue has been fixed below by only serving specific folders within the
<code>node_modules</code> folder.
</p>
<sample src="examples/PrivateFileExposureFixed.js"/>