Skip to content

Commit 80cfe07

Browse files
author
Max Schaefer
committed
JavaScript: Fix inconsistency in MissingRegExpAnchor.qhelp.
1 parent a6cae2b commit 80cfe07

File tree

1 file changed

+2
-3
lines changed

1 file changed

+2
-3
lines changed

javascript/ql/src/Security/CWE-020/MissingRegExpAnchor.qhelp

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -47,9 +47,8 @@
4747
<p>
4848

4949
The check with the regular expression match is, however, easy to bypass. For example
50-
by embedding <code>example.com</code> in the path component:
51-
<code>http://evil-example.net/example.com</code>, or in the query
52-
string component: <code>http://evil-example.net/?x=example.com</code>.
50+
by embedding <code>http://example.com/</code> in the query
51+
string component: <code>http://evil-example.net/?x=http://example.com/</code>.
5352

5453
Address these shortcomings by using anchors in the regular expression instead:
5554

0 commit comments

Comments
 (0)