hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 12:46:34 +01:00
Code Issues Packages Projects Releases Wiki Activity

CPP: Fix typos.

Browse Source
This commit is contained in:
Geoffrey White
2019-10-21 18:39:21 +01:00
parent 47169e2ece
commit faf1a2acbe
6 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
cpp/ql/src/Likely Bugs/Memory Management/Buffer Overflow/BufferAccess.qll
View File

@@ -52,7 +52,7 @@ private class BufferWithSizeConfig extends TaintTracking::Configuration {
} }
/** /**
* An access(read or write) to a buffer, provided as a pair of * An access (read or write) to a buffer, provided as a pair of
* a pointer to the buffer and the length of data to be read or written. * a pointer to the buffer and the length of data to be read or written.
* Extend this class to support different kinds of buffer access. * Extend this class to support different kinds of buffer access.
*/ */

4
csharp/ql/src/Security Features/CWE-327/InsecureSQLConnection.qhelp
View File

@@ -6,7 +6,7 @@
<p>Finds uses of insecure SQL Connections string by not enabling the <code>Encrypt</code> option.</p> <p>Finds uses of insecure SQL Connections string by not enabling the <code>Encrypt</code> option.</p>
<p> <p>
SQL Server connections where the client is not enforcing the encryption in transit are subsceptible to multiple attacks, including a man-in-the-middle, that would potentially compromise the user credentails and/or the TDS session. SQL Server connections where the client is not enforcing the encryption in transit are susceptible to multiple attacks, including a man-in-the-middle, that would potentially compromise the user credentials and/or the TDS session.
</p> </p>
</overview> </overview>
@@ -22,7 +22,7 @@
<sample src="InsecureSQLConnectionBad.cs" /> <sample src="InsecureSQLConnectionBad.cs" />
<p> <p>
The following example shows a SQL connection string that si explicitly enabling the <code>Encrypt</code> setting to force encryption in transit. The following example shows a SQL connection string that is explicitly enabling the <code>Encrypt</code> setting to force encryption in transit.
</p> </p>
<sample src="InsecureSQLConnectionGood.cs" /> <sample src="InsecureSQLConnectionGood.cs" />

2
csharp/ql/src/Security Features/CWE-502/UnsafeDeserialization.qhelp
View File

@@ -17,7 +17,7 @@ as denial-of-service or remote code execution.</p>
<p>In this example, a string is deserialized using a <p>In this example, a string is deserialized using a
<code>JavaScriptSerializer</code> with a simple type resolver. Using a type resolver <code>JavaScriptSerializer</code> with a simple type resolver. Using a type resolver
means that arbitrary code may be executed</p> means that arbitrary code may be executed.</p>
<sample src="UnsafeDeserializationBad.cs" /> <sample src="UnsafeDeserializationBad.cs" />

2
csharp/ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.qhelp
View File

@@ -18,7 +18,7 @@ to use a safe deserialization framework.</p>
<p>In this example, text from an HTML text box is deserialized using a <p>In this example, text from an HTML text box is deserialized using a
<code>JavaScriptSerializer</code> with a simple type resolver. Using a type resolver <code>JavaScriptSerializer</code> with a simple type resolver. Using a type resolver
means that arbitrary code may be executed</p> means that arbitrary code may be executed.</p>
<sample src="UnsafeDeserializationUntrustedInputBad.cs" /> <sample src="UnsafeDeserializationUntrustedInputBad.cs" />

6
csharp/ql/src/semmle/code/csharp/security/cryptography/EncryptionKeyDataFlow.qll
View File

@@ -71,13 +71,13 @@ module EncryptionKeyDataFlow {
class SymmetricKeyTaintTrackingConfiguration extends TaintTracking::Configuration { class SymmetricKeyTaintTrackingConfiguration extends TaintTracking::Configuration {
SymmetricKeyTaintTrackingConfiguration() { this = "SymmetricKeyTaintTracking" } SymmetricKeyTaintTrackingConfiguration() { this = "SymmetricKeyTaintTracking" }
/** holds if the node is a key source. */ /** Holds if the node is a key source. */
override predicate isSource(DataFlow::Node src) { src instanceof KeySource } override predicate isSource(DataFlow::Node src) { src instanceof KeySource }
/** holds if the node is a symmetric encryption key sink. */ /** Holds if the node is a symmetric encryption key sink. */
override predicate isSink(DataFlow::Node sink) { sink instanceof SymmetricEncryptionKeySink } override predicate isSink(DataFlow::Node sink) { sink instanceof SymmetricEncryptionKeySink }
/** holds if the node is a key sanitizer. */ /** Holds if the node is a key sanitizer. */
override predicate isSanitizer(DataFlow::Node sanitizer) { sanitizer instanceof KeySanitizer } override predicate isSanitizer(DataFlow::Node sanitizer) { sanitizer instanceof KeySanitizer }
} }
} }

2
csharp/ql/src/semmle/code/csharp/serialization/Deserializers.qll
View File

@@ -1,5 +1,5 @@
/** /**
* Provides a library of known unsafe deserializers, based on * Provides a library of known unsafe deserializers.
* See https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-Json-Attacks.pdf. * See https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-Json-Attacks.pdf.
*/ */