diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjection.qhelp b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjection.qhelp index 1b9da908864..fa6e5b09410 100644 --- a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjection.qhelp +++ b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjection.qhelp @@ -31,15 +31,13 @@ The next example shows how an untrusted JEXL expression can be run in a sandbox that allows accessing only methods in the java.lang.Math class. The sandbox is implemented using JexlSandbox class that is provided by Apache Commons JEXL 3. -However, it's recommended to avoid using untrusted input in JEXL expressions.

The next example shows another way how a sandbox can be implemented. -It uses a custom implememtation of JexlUberspect +It uses a custom implementation of JexlUberspect that checks if callees are instances of allowed classes. -Again, it's recommended to avoid using untrusted input in JEXL expressions.