зеркало из https://github.com/github/codeql.git
Update javascript/ql/src/experimental/Security/CWE-94/ServerSideTemplateInjection.qhelp
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
This commit is contained in:
Родитель
056566ecc1
Коммит
0aaa8af3bd
|
@ -15,7 +15,7 @@ run arbitrary code on the application server.
|
|||
<p>
|
||||
Avoid including user input in any expression or template which may be dynamically rendered.
|
||||
If user input must be included, use context-specific escaping before including it or run
|
||||
render engine with sandbox options.
|
||||
the rendering engine with sandbox options.
|
||||
</p>
|
||||
</recommendation>
|
||||
|
||||
|
|
Загрузка…
Ссылка в новой задаче