Skip to content

Commit dc8be7b

Browse files
Apply suggestions from code review
Co-authored-by: Erik Krogh Kristensen <[email protected]>
1 parent 71dbd1a commit dc8be7b

File tree

1 file changed

+2
-6
lines changed
  • csharp/ql/src/Security Features/CWE-079

1 file changed

+2
-6
lines changed

csharp/ql/src/Security Features/CWE-079/XSS.qhelp

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ without properly sanitizing the input first, allows for a cross-site scripting v
1313

1414
<p>
1515
To guard against cross-site scripting, consider using a library providing suitable encoding
16-
functionality, such as the <code>System.Net.WebUtility</code> class or the AntiXSS library,
16+
functionality, such as the <code>System.Net.WebUtility</code> class or the <code>AntiXSS</code> NuGet package,
1717
to sanitize the untrusted input before writing it to the page.
1818
The references also mention other possible solutions.
1919
</p>
@@ -31,13 +31,9 @@ Sanitizing the user-controlled data using <code>WebUtility.HtmlEncode</code> met
3131
</p>
3232
<sample src="XSSGood.cs" />
3333
<p>
34-
Alternatively, the AntiXSS library can be used to sanitize the user-controlled data:
34+
Alternatively, the <code>AntiXSS</code> NuGet package can be used to sanitize the user-controlled data:
3535
</p>
3636
<sample src="XSSGood2.cs" />
37-
<p>
38-
Recall that this solution requires the AntiXSS library to be installed, for example by
39-
adding a package reference to the AntiXSS NuGet package to the project file.
40-
</p>
4137

4238
</example>
4339
<references>

0 commit comments

Comments
 (0)