Skip to content

Commit da3eb28

Browse files
asgerfjorgectf
andauthored
Apply suggestions from code review
Co-authored-by: Jorge <[email protected]>
1 parent 2c3117a commit da3eb28

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

docs/codeql/codeql-language-guides/customizing-library-models-for-javascript.rst

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -233,7 +233,7 @@ In this example, we'll show how to add the following SQL injection sink using a
233233
conn.query(q, (err, rows) => {...}); // <-- add 'q' as a SQL injection sink
234234
});
235235
236-
We can recognize this using a fuzzy model, as showin in the following extension:
236+
We can recognize this using a fuzzy model, as shown in the following extension:
237237

238238
.. code-block:: yaml
239239
@@ -244,13 +244,13 @@ We can recognize this using a fuzzy model, as showin in the following extension:
244244
data:
245245
- ["mysql", "Fuzzy.Member[query].Argument[0]", "sql-injection"]
246246
247-
- The first column, **"mysql"**, begins the search at at places where the `mysql` package is imported.
247+
- The first column, **"mysql"**, begins the search at places where the `mysql` package is imported.
248248
- **Fuzzy** selects all objects that appear to originate from the `mysql` package, such as the `pool`, `conn`, `err`, and `rows` objects.
249249
- **Member[query]** selects the **query** member from any of those objects. In this case, the only such member is `conn.query`.
250250
In principle, this would also find expressions such as `pool.query` and `err.query`, but in practice such expressions
251251
are not likely to occur, because the `pool` and `err` objects do not have a member named `query`.
252252
- **Argument[0]** selects the first argument of a call to the selected member, that is, the `q` argument to `conn.query`.
253-
- **sql-injection** indicates that this is considered a sink for the SQL injection query.
253+
- **sql-injection** indicates that this is considered as a sink for the SQL injection query.
254254

255255
For reference, a more detailed model might look like this, as described in the preceding examples:
256256

@@ -485,7 +485,7 @@ The following components are supported:
485485
- **Awaited** selects the value of a promise.
486486
- **Instance** selects instances of a class.
487487
- **Fuzzy** selects all values that are derived from the current value through a combination of the other operations described in this list.
488-
For example, this can be used to find all values the appear to originate from a particular package. This can be useful for finding method calls
488+
For example, this can be used to find all values that appear to originate from a particular package. This can be useful for finding method calls
489489
from a known package, but where the receiver type is not known or is difficult to model.
490490

491491
The following components are called "call site filters". They select a subset of the previously-selected calls, if the call fits certain criteria:

0 commit comments

Comments
 (0)