hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-18 13:34:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Apply suggestions from code review

Browse Source 
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
This commit is contained in:
Max Schaefer
2023-12-19 15:09:42 +00:00
committed by GitHub
parent 71dbd1a059
commit dc8be7bbf0
1 changed files with 2 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
csharp/ql/src/Security Features/CWE-079/XSS.qhelp
View File

@@ -13,7 +13,7 @@ without properly sanitizing the input first, allows for a cross-site scripting v
<p>
To guard against cross-site scripting, consider using a library providing suitable encoding
functionality, such as the <code>System.Net.WebUtility</code> class or the AntiXSS library,
functionality, such as the <code>System.Net.WebUtility</code> class or the <code>AntiXSS</code> NuGet package,
to sanitize the untrusted input before writing it to the page.
The references also mention other possible solutions.
</p>
@@ -31,13 +31,9 @@ Sanitizing the user-controlled data using <code>WebUtility.HtmlEncode</code> met
</p>
<sample src="XSSGood.cs" />
<p>
Alternatively, the AntiXSS library can be used to sanitize the user-controlled data:
Alternatively, the <code>AntiXSS</code> NuGet package can be used to sanitize the user-controlled data:
</p>
<sample src="XSSGood2.cs" />
<p>
Recall that this solution requires the AntiXSS library to be installed, for example by
adding a package reference to the AntiXSS NuGet package to the project file.
</p>
</example>
<references>