Skip to content

Commit c243f2f

Browse files
Improved JexlInjection.qhelp
1 parent 6b66323 commit c243f2f

File tree

1 file changed

+1
-3
lines changed

1 file changed

+1
-3
lines changed

java/ql/src/experimental/Security/CWE/CWE-094/JexlInjection.qhelp

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,15 +31,13 @@ The next example shows how an untrusted JEXL expression can be run
3131
in a sandbox that allows accessing only methods in the <code>java.lang.Math</code> class.
3232
The sandbox is implemented using <code>JexlSandbox</code> class that is provided by
3333
Apache Commons JEXL 3.
34-
However, it's recommended to avoid using untrusted input in JEXL expressions.
3534
</p>
3635
<sample src="SaferJexlExpressionEvaluationWithSandbox.java" />
3736

3837
<p>
3938
The next example shows another way how a sandbox can be implemented.
40-
It uses a custom implememtation of <code>JexlUberspect</code>
39+
It uses a custom implementation of <code>JexlUberspect</code>
4140
that checks if callees are instances of allowed classes.
42-
Again, it's recommended to avoid using untrusted input in JEXL expressions.
4341
</p>
4442
<sample src="SaferJexlExpressionEvaluationWithUberspectSandbox.java" />
4543
</example>

0 commit comments

Comments
 (0)