hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-21 15:05:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

delete multi-char note from the incomplete-sanitization qhelp

Browse Source
This commit is contained in:
erik-krogh
2023-07-03 08:41:01 +02:00
parent a60478ba8a
commit bea4162736
2 changed files with 0 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
ruby/ql/src/queries/security/cwe-116/IncompleteSanitization.qhelp
View File

@@ -37,18 +37,6 @@ An even safer alternative is to design the application so that sanitization is n
Otherwise, make sure to use <code>String#gsub</code> rather than <code>String#sub</code>, to ensure
that all occurrences are replaced, and remember to escape backslashes if applicable.
</p>
<p>
Note, however, that this is generally <i>not</i> sufficient for replacing multi-character strings:
the <code>String#gsub</code> method performs only one pass over the input string, and will not
replace further instances of the string that result from earlier replacements.
</p>
<p>
For example, consider the code snippet <code>s.gsub /\/\.\.\//, ""</code>, which attempts to strip
out all occurrences of <code>/../</code> from <code>s</code>. This will not work as expected: for the
string <code>/./.././</code>, for example, it will remove the single occurrence of <code>/../</code>
in the middle, but the remainder of the string then becomes <code>/../</code>, which is another
instance of the substring we were trying to remove.
</p>
</recommendation>
<example>