Skip to content

Commit fa3d401

Browse files
committed
Swift: Update the qhelp.
1 parent 7cf5210 commit fa3d401

File tree

1 file changed

+4
-6
lines changed

1 file changed

+4
-6
lines changed

swift/ql/src/queries/Security/CWE-020/MissingRegexAnchor.qhelp

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,8 @@
3737
<p>
3838

3939
The following example code checks that a URL redirection
40-
will reach the <code>example.com</code> domain, or one of its
41-
subdomains, and not some malicious site.
40+
will reach the <code>example.com</code> domain, and not
41+
some malicious site.
4242

4343
</p>
4444

@@ -47,9 +47,8 @@
4747
<p>
4848

4949
The check with the regular expression match is, however, easy to bypass. For example
50-
by embedding <code>http://example.com/</code> in the query
51-
string component: <code>http://evil-example.net/?x=http://example.com/</code>.
52-
50+
by embedding <code>http://www.example.com/</code> in the query
51+
string component: <code>http://evil-example.net/?x=http://www.example.com/</code>.
5352
Address these shortcomings by using anchors in the regular expression instead:
5453

5554
</p>
@@ -69,7 +68,6 @@
6968
</example>
7069

7170
<references>
72-
<li>MDN: <a href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions">Regular Expressions</a></li>
7371
<li>OWASP: <a href="https://www.owasp.org/index.php/Server_Side_Request_Forgery">SSRF</a></li>
7472
<li>OWASP: <a href="https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html">XSS Unvalidated Redirects and Forwards Cheat Sheet</a>.</li>
7573
</references>

0 commit comments

Comments
 (0)