Update java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll

haby0 · smowton · web-flow · commit 4c21980d4f34 · 2021-04-10T04:29:30.000+08:00
Co-authored-by: Chris Smowton &lt;smowton@github.com&gt;
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -141,7 +141,7 @@ class JsonDataFlowConfig extends DataFlow2::Configuration {
   }
 }
 
-/** Taint-tracking configuration tracing flow from user-controllable function name jsonp data to output jsonp data. */
+/** Taint-tracking configuration tracing flow from probable jsonp data with a user-controlled function name to an outgoing HTTP entity. */
 class JsonpInjectionFlowConfig extends TaintTracking::Configuration {
   JsonpInjectionFlowConfig() { this = "JsonpInjectionFlowConfig" }
 

Original file line number	Diff line number	Diff line change
`@@ -141,7 +141,7 @@ class JsonDataFlowConfig extends DataFlow2::Configuration {`
`141`	`141`	`}`
`142`	`142`	`}`
`143`	`143`
`144`		`-/** Taint-tracking configuration tracing flow from user-controllable function name jsonp data to output jsonp data. */`
	`144`	`+/** Taint-tracking configuration tracing flow from probable jsonp data with a user-controlled function name to an outgoing HTTP entity. */`
`145`	`145`	`class JsonpInjectionFlowConfig extends TaintTracking::Configuration {`
`146`	`146`	`JsonpInjectionFlowConfig() { this = "JsonpInjectionFlowConfig" }`
`147`	`147`