Skip to content

Commit 34ae6e0

Browse files
Apply suggestions from code review
Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com>
1 parent 77b551b commit 34ae6e0

File tree

2 files changed

+3
-3
lines changed

2 files changed

+3
-3
lines changed

java/ql/src/Security/CWE/CWE-094/InsecureBeanValidation.qhelp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ Validator validator = Validation.byDefaultProvider()
3030
.buildValidatorFactory()
3131
.getValidator();
3232
</pre></li>
33-
<li>Replace Hibernate Validator with Apache BVal which in its latest version does not interpolate EL expressions by default.
33+
<li>Replace Hibernate Validator with Apache BVal, which in its latest version does not interpolate EL expressions by default.
3434
Note that this replacement may not be a simple drop-in replacement.</li>
3535
</ul>
3636
</recommendation>
@@ -41,7 +41,7 @@ Note that this replacement may not be a simple drop-in replacement.</li>
4141
</example>
4242

4343
<references>
44-
<li>Hibernate Reference Guide:<a href="https://docs.jboss.org/hibernate/stable/validator/reference/en-US/html_single/#_the_code_constraintvalidatorcontext_code">ConstraintValidatorContext</a>.</li>
44+
<li>Hibernate Reference Guide: <a href="https://docs.jboss.org/hibernate/stable/validator/reference/en-US/html_single/#_the_code_constraintvalidatorcontext_code">ConstraintValidatorContext</a>.</li>
4545
<li>GitHub Security Lab research: <a href="https://securitylab.github.com/research/bean-validation-RCE">Bean validation</a>.</li>
4646
</references>
4747
</qhelp>

java/ql/src/Security/CWE/CWE-094/InsecureBeanValidation.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/**
22
* @name Insecure Bean Validation
3-
* @description User-controlled data may be evaluated as a Java EL expressions, leading to arbitrary code execution.
3+
* @description User-controlled data may be evaluated as a Java EL expression, leading to arbitrary code execution.
44
* @kind path-problem
55
* @problem.severity error
66
* @precision high

0 commit comments

Comments
 (0)