Skip to content

Commit 8a778da

Browse files
Apply suggestions from docs review
Co-authored-by: Ben Ahmady <[email protected]>
1 parent 462be46 commit 8a778da

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

python/ql/src/Security/CWE-074/TemplateInjection.qhelp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
<recommendation>
99
<p>
1010
Ensure that an untrusted value is not used to directly construct a template.
11-
Jinja also provides a <code>SandboxedEnvironment</code> that prohibits access to unsafe methods and attributes, that can be used if constructing a template from user input is absolutely necessary.
11+
Jinja also provides <code>SandboxedEnvironment</code> that prohibits access to unsafe methods and attributes. This can be used if constructing a template from user input is absolutely necessary.
1212
</p>
1313
</recommendation>
1414
<example>
@@ -18,7 +18,7 @@
1818
<p>The following is an example of a string that could be used to cause remote code execution when interpreted as a template:</p>
1919
<sample src="examples/template_exploit.txt" />
2020

21-
<p>In the following case, user input is not used to construct the template; rather it is only used as the parameters to render the template, which is safe.</p>
21+
<p>In the following case, user input is not used to construct the template. Instead, it is only used as the parameters to render the template, which is safe.</p>
2222
<sample src="examples/JinjaGoodParam.py" />
2323

2424
<p>In the following case, a <code>SandboxedEnvironment</code> is used, preventing remote code execution.</p>

0 commit comments

Comments
 (0)