Skip to content

Commit 5a96ee1

Browse files
lcarteyMarcono1234
andauthored
Remove parameter names from signatures
Co-authored-by: Marcono1234 <[email protected]>
1 parent 368572f commit 5a96ee1

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

java/ql/src/Security/CWE/CWE-020/ExternalAPIsUsedWithUntrustedData.qhelp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,11 +33,11 @@ class to exclude known safe external APIs from future analysis.</p>
3333
</recommendation>
3434
<example>
3535

36-
<p>If the query were to return the API <code>javax.servlet.http.HttpServletResponse.sendError(int sc, java.lang.String msg) [param 1]</code>
36+
<p>If the query were to return the API <code>javax.servlet.http.HttpServletResponse.sendError(int, java.lang.String) [param 1]</code>
3737
then we should first consider whether this a security relevant sink. In this case, this is writing to a HTTP response, so we should
3838
consider whether this is an XSS sink. If it is, we should confirm that it is handled by the XSS query.</p>
3939

40-
<p>If the query were to return the API <code>java.lang.StringBuilder.append(java.lang.String str) [param 0]</code>, then this should be
40+
<p>If the query were to return the API <code>java.lang.StringBuilder.append(java.lang.String) [param 0]</code>, then this should be
4141
reviewed as a possible taint step, because tainted data would flow from the 0th argument to the qualifier of the call.</p>
4242

4343
<p>Note that both examples are correctly handled with the standard taint tracking library and XSS query.</p>

0 commit comments

Comments
 (0)