Skip to content

Commit a801970

Browse files
Update javascript/ql/src/experimental/Security/CWE-94/ServerSideTemplateInjection.qhelp
Co-authored-by: Erik Krogh Kristensen <[email protected]>
1 parent 0aaa8af commit a801970

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

javascript/ql/src/experimental/Security/CWE-94/ServerSideTemplateInjection.qhelp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ The Pug template engine (and other template engines) provides an interpolation f
2727
For example, <code>Hello #{user.username}!</code>, could be used for printing a username from a scoped variable user,
2828
but the <code>user.username</code> expression will be executed as JavaScript.
2929
Unsafe injection of user input in a template therefore allows an attacker to inject arbitrary JavaScript code.
30-
For example, a payload of <code>#{global.process.exit(1)}</code> will cause the server to crash.
30+
For example, a payload of <code>#{global.process.exit(1)}</code> will cause the below server to crash.
3131
</p>
3232

3333
<sample src="examples/ServerSideTemplateInjection.js" />

0 commit comments

Comments
 (0)