From ee4356501aad78901f48bec7de1e43fa40da34e5 Mon Sep 17 00:00:00 2001 From: Slavomir Date: Thu, 16 Jul 2020 18:36:40 +0300 Subject: [PATCH] Apply suggestions from code review Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com> --- ql/src/experimental/CWE-352/ConstantOauth2State.qhelp | 6 +++--- ql/src/experimental/CWE-352/ConstantOauth2State.ql | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/ql/src/experimental/CWE-352/ConstantOauth2State.qhelp b/ql/src/experimental/CWE-352/ConstantOauth2State.qhelp index 4d14d003781..dc15b5de1d9 100644 --- a/ql/src/experimental/CWE-352/ConstantOauth2State.qhelp +++ b/ql/src/experimental/CWE-352/ConstantOauth2State.qhelp @@ -4,8 +4,8 @@

- Oauth2 clients must implement CSRF protection for the redirection URI, which is typically accomplished by including a "state" value that binds the request to - the user's authenticated state. The Go Oauth2 library allows to specify a "state" value which is then included in the auth code URL, and then provided back by the remote authentication server in the redirect callback, from where it must be validated; failure to do so makes the client susceptible to an CSRF attack. + OAuth 2.0 clients must implement CSRF protection for the redirection URI, which is typically accomplished by including a "state" value that binds the request to + the user's authenticated state. The Go OAuth 2.0 library allows to specify a "state" value which is then included in the auth code URL, and then provided back by the remote authentication server in the redirect callback, from where it must be validated; failure to do so makes the client susceptible to an CSRF attack.

@@ -23,4 +23,4 @@

- \ No newline at end of file + diff --git a/ql/src/experimental/CWE-352/ConstantOauth2State.ql b/ql/src/experimental/CWE-352/ConstantOauth2State.ql index 43f35befc99..46eed76acaf 100644 --- a/ql/src/experimental/CWE-352/ConstantOauth2State.ql +++ b/ql/src/experimental/CWE-352/ConstantOauth2State.ql @@ -1,6 +1,6 @@ /** - * @name Use of constant `state` value in Oauth2 URL. - * @description Using a constant value for the `state` in the oauth2 URL makes the application + * @name Use of constant `state` value in OAuth 2.0 URL. + * @description Using a constant value for the `state` in the OAuth 2.0 URL makes the application * susceptible to CSRF attacks. * @kind path-problem * @problem.severity error @@ -14,7 +14,7 @@ import DataFlow::PathGraph /** * A method that creates a new URL that will send the user - * to the oauth2 authorization dialog of the provider. + * to the OAuth 2.0 authorization dialog of the provider. */ class AuthCodeURL extends Method { AuthCodeURL() { this.hasQualifiedName("golang.org/x/oauth2", "Config", "AuthCodeURL") }