hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-21 15:06:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

JS: address doc review comments

Browse Source
This commit is contained in:
Esben Sparre Andreasen
2018-12-14 10:24:30 +01:00
parent 1bc73ab592
commit bb3e3a541d
3 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
javascript/ql/src/Security/CWE-020/IncompleteHostnameRegExp.qhelp
View File

@@ -21,7 +21,7 @@
Even if the check is not used in a security-critical
context, the incomplete check may still cause undesirable behaviors
when the check succeeds accidentally.
when it accidentally succeeds.
</p>
</overview>
@@ -55,6 +55,9 @@
<code>example.com</code>, effectively allowing the redirect to go to
an attacker-controlled domain such as <code>wwwXexample.com</code>.
<p>
</p>
Address this vulnerability by escaping <code>.</code>
appropriately: <code>let regex = /(www|beta|)\.example\.com/</code>.

2
javascript/ql/src/Security/CWE-020/IncompleteHostnameRegExp.ql
View File

@@ -1,6 +1,6 @@
/**
* @name Incomplete regular expression for hostnames
* @description Matching a URL or hostname against a regular expression that contains an unescaped dot as part of the hostname might match more than expected.
* @description Matching a URL or hostname against a regular expression that contains an unescaped dot as part of the hostname might match more hostnames than expected.
* @kind problem
* @problem.severity warning
* @precision high