Skip to content

Commit 25df6e1

Browse files
Update javascript/ql/src/experimental/Security/CWE-94/ServerSideTemplateInjection.qhelp
Co-authored-by: Erik Krogh Kristensen <[email protected]>
1 parent 700a070 commit 25df6e1

File tree

1 file changed

+3
-4
lines changed

1 file changed

+3
-4
lines changed

javascript/ql/src/experimental/Security/CWE-94/ServerSideTemplateInjection.qhelp

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -36,10 +36,9 @@ curl -i -s -k -X $'POST' -H $'Host: 127.0.0.1:5061' -H $'Connection: close' -H $
3636

3737
<example>
3838
<p>
39-
As the example of safe usage of rendering engine, please see example below.
40-
In opposite to first example, instead of concatenation of provided user input with the template
41-
it is possible to provide user input as a context - user input will be safely insterted
42-
and rendered inside correspondent placeholders.
39+
The example below provides an example of how to use a template engine without any risk of Server-Side Template Injection.
40+
Instead of concatenating user input onto the template, the template uses a placeholder and safely inserts
41+
the user input.
4342
</p>
4443

4544
<sample src="examples/ServerSideTemplateInjectionSafe.js" />

0 commit comments

Comments
 (0)