File tree Expand file tree Collapse file tree 1 file changed +4
-4
lines changed
ruby/ql/src/experimental/cwe-176 Expand file tree Collapse file tree 1 file changed +4
-4
lines changed Original file line number Diff line number Diff line change 16
16
<example >
17
17
18
18
<p > The following example showcases the bypass of all checks performed by <code >
19
- flask.escape ()</code > due to a post-unicode normalization.</p >
20
- <p >For instance: the character U+FE64 (<code >﹤</code >) is not filtered-out by the flask
21
- escape function. But due to the Unicode normalization, the character is transformed and
22
- would become U+003C (<code > < </code > ).</p >
19
+ html_escape ()</code > due to a post-unicode normalization.</p >
20
+ <p >For instance: the character U+FE64 (<code >﹤</code >) is not filtered-out by the
21
+ html_escape() function. But due to the Unicode normalization, the character is
22
+ transformed and would become U+003C (<code > < </code > ).</p >
23
23
24
24
<sample src =" ./examples/unicode_normalization.rb" />
25
25
You can’t perform that action at this time.
0 commit comments