mirror of
https://github.com/github/codeql.git
synced 2026-04-28 18:25:24 +02:00
rename files
This commit is contained in:
@@ -24,13 +24,13 @@ The example below uses a received message to execute some code. However, the
|
||||
origin of the message is not checked, so it might be possible for an attacker
|
||||
to execute arbitrary code.
|
||||
</p>
|
||||
<sample src="examples/postMessageNoOriginCheck.js" />
|
||||
<sample src="examples/MissingOriginCheckBad.js" />
|
||||
|
||||
<p>
|
||||
The example is fixed below, where the origin is checked to be trusted.
|
||||
It is therefore not possible for an attacker to attack using an untrusted origin.
|
||||
</p>
|
||||
<sample src="examples/postMessageWithOriginCheck.js" />
|
||||
<sample src="examples/MissingOriginCheckGood.js" />
|
||||
|
||||
</example>
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
* @problem.severity warning
|
||||
* @security-severity 5
|
||||
* @precision medium
|
||||
* @id js/missing-origin-verification
|
||||
* @id js/missing-origin-check
|
||||
* @tags correctness
|
||||
* security
|
||||
* external/cwe/cwe-020
|
||||
@@ -0,0 +1 @@
|
||||
Security/CWE-020/MissingOriginCheck.ql
|
||||
@@ -1 +0,0 @@
|
||||
Security/CWE-020/PostMessageNoOriginCheck.ql
|
||||
Reference in New Issue
Block a user