Skip to content

Commit c933ab4

Browse files
owen-mcsmowton
andauthored
Apply suggestions from code review
Co-authored-by: Chris Smowton <[email protected]>
1 parent 9ba47eb commit c933ab4

File tree

2 files changed

+2
-2
lines changed

2 files changed

+2
-2
lines changed

go/ql/src/Security/CWE-079/HtmlTemplateEscapingBypassXss.ql

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* @name HTML template escaping bypass cross-site scripting
2+
* @name Cross-site scripting via HTML template escaping bypass
33
* @description Converting user input to a special type that avoids escaping
44
* when fed into an HTML template allows for a cross-site
55
* scripting vulnerability.
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
---
22
category: newQuery
33
---
4-
* A new query (`go/html-template-escaping-bypass-xss`) has been promoted to the main query suite. This query finds potential cross-site scripting (XSS) vulnerabilities when using the `html/template` package, caused by user input being cast to a type which bypasses the HTML autoescaping. It was originally contributed to the experimental query pack by @gagliardetto in <https://github.com/github/codeql-go/pull/493>.
4+
* Query (`go/html-template-escaping-bypass-xss`) has been promoted to the main query suite. This query finds potential cross-site scripting (XSS) vulnerabilities when using the `html/template` package, caused by user input being cast to a type which bypasses the HTML autoescaping. It was originally contributed to the experimental query pack by @gagliardetto in <https://github.com/github/codeql-go/pull/493>.

0 commit comments

Comments
 (0)