hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-04 05:05:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

apply documentation suggestions

Browse Source 
Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com>
This commit is contained in:
Erik Krogh Kristensen
2022-01-25 12:14:16 +01:00
committed by GitHub
parent d4bac887cf
commit 9f9dee5d18
3 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
javascript/ql/src/Security/CWE-1275/SameSiteNoneCookie.qhelp
View File

@@ -6,11 +6,11 @@
<overview>
<p>
Authentication cookies where the SameSite attribute is set to "None" can
potentially be used to perform cross-site request forgery (CSRF) attacks
potentially be used to perform Cross-Site Request Forgery (CSRF) attacks
if no other CSRF protections are in place.
</p>
<p>
With SameSite set to "None" a third party website may create an authorized cross-site request
With SameSite set to "None", a third party website may create an authorized cross-site request
that includes the cookie.
Such a cross-site request can allow that website to perform actions on behalf of a user.
</p>

2
javascript/ql/src/Security/CWE-1275/SameSiteNoneCookie.ql
View File

@@ -1,7 +1,7 @@
/**
* @name Sensitive cookie without SameSite restrictions
* @description Sensitive cookies where the SameSite attribute is set to "None" can
* in some cases allow for Cross-site request forgery (CSRF) attacks.
* in some cases allow for Cross-Site Request Forgery (CSRF) attacks.
* @kind problem
* @problem.severity warning
* @security-severity 5.0

2
javascript/ql/src/change-notes/2022-01-24-samesite-cookie.md
View File

@@ -1,4 +1,4 @@
---
category: newQuery
---
* A new query `js/samesite-none-cookie` has been added. The query detects when the SameSite attribute on a sensitive cookie is set to None.
* A new query `js/samesite-none-cookie` has been added. The query detects when the SameSite attribute is set to None on a sensitive cookie.