hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-22 07:26:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

JS: address doc review

Browse Source
This commit is contained in:
Asger F
2018-10-01 10:58:38 +01:00
parent e4c8653549
commit d005d7127f
3 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
javascript/ql/src/Security/CWE-640/HostHeaderPoisoningInEmailGeneration.qhelp
View File

@@ -5,7 +5,7 @@
<p>
Using the HTTP Host header to construct a link in an email can facilitate phishing attacks and leak password reset tokens.
A malicious user can send an HTTP request to the targeted web site, but with a Host header that refers to his own web site.
This means the emails will be sent out to potential victims, originating from a server they trust but with
This means the emails will be sent out to potential victims, originating from a server they trust, but with
links leading to a malicious web site.
</p>
<p>

2
javascript/ql/src/Security/CWE-640/examples/HostHeaderPoisoningInEmailGeneration.js
View File

@@ -14,6 +14,6 @@ app.post('/resetpass', (req, res) => {
from: 'webmaster@example.com',
to: email,
subject: 'Forgot password',
text: `Forgot your password?. Click here to reset: https://${req.host}/resettoken/${token}`,
text: `Click to reset password: https://${req.host}/resettoken/${token}`,
});
});

2
javascript/ql/src/Security/CWE-640/examples/HostHeaderPoisoningInEmailGenerationGood.js
View File

@@ -14,6 +14,6 @@ app.post('/resetpass', (req, res) => {
from: 'webmaster@example.com',
to: email,
subject: 'Forgot password',
text: `Forgot your password?. Click here to reset: https://${config.hostname}/resettoken/${token}`,
text: `Click to reset password: https://${config.hostname}/resettoken/${token}`,
});
});