Skip to content

Commit 6ffaa69

Browse files
authored
Apply suggestions from code review
1 parent 04c230b commit 6ffaa69

File tree

2 files changed

+2
-2
lines changed

2 files changed

+2
-2
lines changed

java/ql/src/experimental/Security/CWE/CWE-625/PermissiveDotRegex.qhelp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<qhelp>
55

66
<overview>
7-
<p>By default, a "dot" (<code>.</code>) in a regular expression matches all characters except the new line characters <code>\n</code> and
7+
<p>By default, a "dot" (<code>.</code>) in a regular expression matches all characters except the newline characters <code>\n</code> and
88
<code>\r</code>. Regular expressions containing a dot can be bypassed with the characters <code>\r</code>(<code>%0a</code>) and
99
<code>\n</code>(<code>%0d</code>) when the default Java regular expression matching implementations are used. This becomes a security issue
1010
if these regular expressions are used to decide whether to grant access to protected application resources.</p>

java/ql/src/experimental/Security/CWE/CWE-625/PermissiveDotRegexQuery.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ private class PermissiveDotStr extends StringLiteral {
1919
}
2020
}
2121

22-
/** Remote flow sources obtained from the URI of a serlvet request. */
22+
/** Remote flow sources obtained from the URI of a servlet request. */
2323
private class GetServletUriSource extends SourceModelCsv {
2424
override predicate row(string row) {
2525
row =

0 commit comments

Comments
 (0)