Elaborate 'guess' to 'guess or determine'

Author: joefarebrother

csharp/ql/src/Security Features/CWE-639/InsecureDirectObjectReference.qhelp

@@ -3,7 +3,7 @@
   "qhelp.dtd">
 <qhelp>
 <overview>
-<p>Resources like comments or user profiles can be accessed and modified through an action method. To find a specific resource, the action method accepts an ID parameter that determines which resource to access. If the methods do not check that the current user is authorized to access the specified resource, an attacker can access a resource by guessing the ID parameter.</p>
+<p>Resources like comments or user profiles can be accessed and modified through an action method. To target a certain resource, the action method accepts an ID parameter pointing to that specific resource. If the methods do not check that the current user is authorized to access the specified resource, an attacker can access a resource by guessing or otherwise determining the linked ID parameter.</p>
 
 </overview>
 <recommendation>
@@ -13,7 +13,7 @@ Ensure that the current user is authorized to access the resource of the provide
 
 </recommendation>
 <example>
-<p>In the following example, in the "BAD" case, there is no authorization check, so any user can edit any comment for which they guess the ID parameter.
+<p>In the following example, in the "BAD" case, there is no authorization check, so any user can edit any comment for which they guess or determine the ID parameter.
 The "GOOD" case includes a check that the current user matches the author of the comment, preventing unauthorized access.</p>
 <sample src="WebFormsExample.cs" />
 <p>The following example shows a similar scenario for the ASP.NET Core framework. As above, the "BAD" case provides an example with no authorization check, and the first "GOOD" case provides an example with a check that the current user authored the specified comment. Additionally, in the second "GOOD" case, the `Authorize` attribute is used to restrict the method to administrators, who are expected to be able to access arbitrary resources.</p>