Apply suggestions from doc review

Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com>
This commit is contained in:
Asger F
2022-07-14 09:38:10 +02:00
committed by GitHub
parent c33690381e
commit da8123072d
3 changed files with 5 additions and 5 deletions

View File

@@ -7,21 +7,21 @@
<p>
Using a case-sensitive regular expression path in a middleware route enables an attacker to bypass that middleware
when accessing an endpoint with a case-insensitive path.
Paths specified using a string are case insensitive, whereas regular expressions are case sensitive by default.
Paths specified using a string are case-insensitive, whereas regular expressions are case-sensitive by default.
</p>
</overview>
<recommendation>
<p>
When using a regular expression as a middleware path, make sure the regular expression is
case insensitive by adding the <code>i</code> flag.
case-insensitive by adding the <code>i</code> flag.
</p>
</recommendation>
<example>
<p>
The following example restricts access to paths in the <code>/admin</code> path to users logged in as
an administrator:
administrators:
</p>
<sample src="examples/CaseSensitiveMiddlewarePath.js" />
<p>

View File

@@ -1,6 +1,6 @@
/**
* @name Case-sensitive middleware path
* @description Middleware with case-sensitive paths do not protect endpoints with case-insensitive paths
* @description Middleware with case-sensitive paths do not protect endpoints with case-insensitive paths.
* @kind problem
* @problem.severity warning
* @security-severity 7.3

View File

@@ -2,5 +2,5 @@
category: newQuery
---
- A new query "case sensitive middleware path" (`js/case-sensitive-middleware-path`) has been added.
- A new query "Case-sensitive middleware path" (`js/case-sensitive-middleware-path`) has been added.
It highlights middleware routes that can be bypassed due to having a case-sensitive regular expression path.