hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-30 06:42:57 +01:00
Code Issues Packages Projects Releases Wiki Activity

Apply suggestions from review

Browse Source 
Co-Authored-By: Max Schaefer <54907921+max-schaefer@users.noreply.github.com>
This commit is contained in:
intrigus-lgtm
2020-03-20 13:55:31 +01:00
committed by intrigus
parent d6ff6b74c5
commit ec40cf0379
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
ql/src/experimental/Security/CWE-643/XPathInjection.qhelp
View File

@@ -15,10 +15,10 @@ If user input must be included in an XPath expression, pre-compile the query and
references to include the user input.
</p>
<p>
For exmaple, when using the <code>github.com/moovweb/gokogiri</code> API, this can be done by creating a custom subtype of
For example, when using the <code>github.com/moovweb/gokogiri</code> API, this can be done by creating a custom subtype of
<code>xpath.VariableScope</code>, and implementing
<code>ResolveVariable(string, string)</code> to return the user provided data. This
custom scope can be specified when calling <code>SearchWithVariables(), EvalXPath() or EvalXPathAsBoolean()</code>.
custom scope can be specified when calling <code>SearchWithVariables()</code>, <code>EvalXPath()</code>, or <code>EvalXPathAsBoolean()</code>.
</p>
</recommendation>

4
ql/src/experimental/Security/CWE-643/XPathInjection.ql
View File

@@ -139,5 +139,5 @@ class GokogiriSink extends XPathInjectionSink {
from DataFlow::PathNode source, DataFlow::PathNode sink, XPathInjectionConfiguration c
where c.hasFlowPath(source, sink)
select sink.getNode(), source, sink, "$@ flows to here and is used in an XPath expression.",
source.getNode(), "User-provided value"
select sink.getNode(), source, sink, "$@ flows here and is used in an XPath expression.",
source.getNode(), "A user-provided value"