Skip to content

Commit ee62881

Browse files
committed
Ruby: remove extra opening p tag
1 parent 60f3138 commit ee62881

File tree

1 file changed

+9
-6
lines changed

1 file changed

+9
-6
lines changed

ruby/ql/src/experimental/template-injection/TemplateInjection.qhelp

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -17,11 +17,14 @@ use a sandboxed environment where access to unsafe attributes and methods is pro
1717

1818
<example>
1919
<p>
20-
<p>Consider the example given below, an untrusted HTTP parameter <code>name</code> is used to generate a template string. This can lead to remote code execution. </p>
21-
<sample src="examples/SSTIBad.rb" />
22-
23-
<p>Here we have fixed the problem by including ERB/Slim syntax in the string, then the user input will be rendered but no evaluated.</p>
24-
<sample src="examples/SSTIGood.rb" />
20+
Consider the example given below, an untrusted HTTP parameter <code>name</code> is used to generate a template string. This can lead to remote code execution.
21+
</p>
22+
<sample src="examples/SSTIBad.rb" />
23+
24+
<p>
25+
Here we have fixed the problem by including ERB/Slim syntax in the string, then the user input will be rendered but no evaluated.
26+
</p>
27+
<sample src="examples/SSTIGood.rb" />
2528
</example>
2629

2730
<references>
@@ -32,4 +35,4 @@ Wikipedia: <a href="https://en.wikipedia.org/wiki/Code_injection#Server_Side_Tem
3235
Portswigger : <a href="https://portswigger.net/web-security/server-side-template-injection">Server Side Template Injection</a>.
3336
</li>
3437
</references>
35-
</qhelp>
38+
</qhelp>

0 commit comments

Comments
 (0)