hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 11:45:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Apply style suggestions

Browse Source
This commit is contained in:
intrigus
2020-03-27 15:29:21 +01:00
parent b24c23389c
commit c5a1185939
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
ql/src/Security/CWE-643/XPathInjection.qhelp
View File

@@ -15,16 +15,16 @@ If user input must be included in an XPath expression, pre-compile the query and
references to include the user input.
</p>
<p>
For example, when using the <code>github.com/ChrisTrenkamp/goxpath</code> API, this can be done by creating a function that takes an <code>*goxpath.Opts</code> structure.
For example, when using the <code>github.com/ChrisTrenkamp/goxpath</code> API, you can do this by creating a function that takes an <code>*goxpath.Opts</code> structure.
In this structure you can then set the values of the variable references.
This function can then be specified when calling <code>Exec()</code>, <code>Exec{Bool|Num|Node}()</code>, <code>ParseExec()</code> or <code>MustExec()</code>.
This function can then be specified when calling <code>Exec()</code>, <code>Exec{Bool|Num|Node}()</code>, <code>ParseExec()</code>, or <code>MustExec()</code>.
</p>
</recommendation>
<example>
<p>
In the first example, the code accepts a user name specified by the user, and uses this
In the first example, the code accepts a username specified by the user, and uses this
unvalidated and unsanitized value in an XPath expression. This is vulnerable to the user providing
special characters or string sequences that change the meaning of the XPath expression to search
for different values.