hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-07-20 18:58:36 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #17795 from jcogs33/jcogs33/update-spring-csrf-qhelp-link

Browse Source 
Java: update qhelp link for `java/spring-disabled-csrf-protection`
This commit is contained in:
Jami
2024-10-18 10:11:37 -04:00
committed by GitHub
parent 41e811773c 335c59792c
commit c8d420ec57
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
java/ql/src/Security/CWE/CWE-352/SpringCSRFProtection.qhelp
View File

@@ -5,7 +5,7 @@
<p>When you set up a web server to receive a request from a client without any mechanism
for verifying that it was intentionally sent, then it is vulnerable to attack. An attacker can
trick a client into making an unintended request to the web server that will be treated as
an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can
an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can
result in exposure of data or unintended code execution.</p>
</overview>
@@ -30,9 +30,9 @@ OWASP:
</li>
<li>
Spring Security Reference:
<a href="https://docs.spring.io/spring-security/site/docs/current/reference/html5/#servlet-csrf">
Cross Site Request Forgery (CSRF) for Servlet Environments
<a href="https://docs.spring.io/spring-security/reference/servlet/exploits/csrf.html">
Cross Site Request Forgery (CSRF)
</a>.
</li>
</references>
</qhelp>
</qhelp>