python: rewrite qhelp overview

(combining the Java version and the JS version)

Author: yoff

python/ql/src/Security/CWE-117/LogInjection.qhelp

@@ -8,8 +8,11 @@
 
 <p>If unsanitized user input is written to a log entry, a malicious user may be able to forge new log entries.</p>
 
-<p>Forgery can occur if a user provides some input creating the appearance of multiple
-  log entries. This can include unescaped new-line characters, or HTML or other markup.</p>
+<p>Forgery can occur if a user provides some input with characters that are interpreted
+when the log output is displayed. If the log is displayed as a plain text file, then new
+line characters can be used by a malicious user to create the appearance of multiple log
+entries. If the log is displayed as HTML, then arbitrary HTML may be included to spoof
+log entries.</p>
 </overview>
 
 <recommendation>
@@ -29,14 +32,14 @@ other forms of HTML injection.
 
 <example>
 <p>
-In the example, the name provided by the user is recorded using the log output function (<code>logging.info</code> or <code>app.logger.info</code>, etc.). 
-In these four cases, the name provided by the user is not provided The processing is recorded. If a malicious user provides <code>Guest%0D%0AUser name: Admin</code> 
+In the example, the name provided by the user is recorded using the log output function (<code>logging.info</code> or <code>app.logger.info</code>, etc.).
+In these four cases, the name provided by the user is not provided The processing is recorded. If a malicious user provides <code>Guest%0D%0AUser name: Admin</code>
 as a parameter, the log entry will be divided into two lines, the first line is <code>User name: Guest</code> code>, the second line is <code>User name: Admin</code>.
 </p>
 <sample src="LogInjectionBad.py" />
 
 <p>
-In a good example, the program uses the <code>replace</code> function to provide parameter processing to the user, and replace <code>\r\n</code> and <code>\n</code> 
+In a good example, the program uses the <code>replace</code> function to provide parameter processing to the user, and replace <code>\r\n</code> and <code>\n</code>
 with empty characters. To a certain extent, the occurrence of log injection vulnerabilities is reduced.
 </p>