Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit ed74e0a

Browse files
nickrolfenickrolfe
committed
JS/Python/Ruby: s/a HTML/an HTML/
1 parent 9b03e1c commit ed74e0a

16 files changed

Lines changed: 62 additions & 62 deletions

File tree

‎javascript/ql/lib/semmle/javascript/JSX.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ class JsxElement extends JsxNode {
7070
override string getAPrimaryQlClass() { result = "JsxElement" }
7171

7272
/**
73-
* Holds if this JSX element is a HTML element.
73+
* Holds if this JSX element is an HTML element.
7474
* That is, the name starts with a lowercase letter.
7575
*/
7676
predicate isHtmlElement() { getName().regexpMatch("[a-z].*") }

‎javascript/ql/lib/semmle/javascript/security/BadTagFilterQuery.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ predicate isBadRegexpFilter(HtmlMatchingRegExp regexp, string msg) {
8787
not regexp.fillsCaptureGroup("<script>", group) and
8888
msg =
8989
"This regular expression only parses --> (capture group " + group +
90-
") and not --!> as a HTML comment end tag."
90+
") and not --!> as an HTML comment end tag."
9191
)
9292
or
9393
regexp.matches("<!-- foo -->") and

‎javascript/ql/lib/semmle/javascript/security/IncompleteBlacklistSanitizer.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ module HtmlSanitization {
8080
}
8181

8282
/**
83-
* Gets a HTML-relevant character that is replaced by `chain`.
83+
* Gets an HTML-relevant character that is replaced by `chain`.
8484
*/
8585
private string getALikelyReplacedCharacter(StringReplaceCallSequence chain) {
8686
result = "\"" and

‎javascript/ql/lib/semmle/javascript/security/IncompleteMultiCharacterSanitizationQuery.qll‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ private DangerousPrefixSubstring getADangerousMatchedChar(EmptyReplaceRegExpTerm
3535
or
3636
result = t.getAMatchedString()
3737
or
38-
// A substring matched by some character class. This is only used to match the "word" part of a HTML tag (e.g. "iframe" in "<iframe").
38+
// A substring matched by some character class. This is only used to match the "word" part of an HTML tag (e.g. "iframe" in "<iframe").
3939
exists(NfaUtils::CharacterClass cc |
4040
cc = NfaUtils::getCanonicalCharClass(t) and
4141
cc.matches(result) and
@@ -101,12 +101,12 @@ private class RepetitionMatcher extends EmptyReplaceRegExpTerm {
101101
predicate matchesDangerousPrefix(EmptyReplaceRegExpTerm t, string prefix, string kind) {
102102
prefix = getADangerousMatchedPrefix(t) and
103103
(
104-
kind = "path injection" and
104+
kind = "a path injection vulnerability" and
105105
prefix = ["/..", "../"] and
106106
// If the regex is matching explicit path components, it is unlikely that it's being used as a sanitizer.
107107
not t.getSuccessor*().getAMatchedString().regexpMatch("(?is).*[a-z0-9_-].*")
108108
or
109-
kind = "HTML element injection" and
109+
kind = "an HTML element injection vulnerability" and
110110
(
111111
// comments
112112
prefix = "<!--" and
@@ -119,7 +119,7 @@ predicate matchesDangerousPrefix(EmptyReplaceRegExpTerm t, string prefix, string
119119
)
120120
)
121121
or
122-
kind = "HTML attribute injection" and
122+
kind = "an HTML attribute injection vulnerability" and
123123
prefix =
124124
[
125125
// ordinary event handler prefix
@@ -197,6 +197,6 @@ query predicate problems(
197197
) {
198198
exists(string kind |
199199
isResult(replace, dangerous, prefix, kind) and
200-
msg = "This string may still contain $@, which may cause a " + kind + " vulnerability."
200+
msg = "This string may still contain $@, which may cause " + kind + "."
201201
)
202202
}

‎javascript/ql/lib/semmle/javascript/security/dataflow/ImproperCodeSanitizationCustomizations.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ module ImproperCodeSanitization {
2626
abstract class Sanitizer extends DataFlow::Node { }
2727

2828
/**
29-
* A call to a HTML sanitizer seen as a source for improper code sanitization
29+
* A call to an HTML sanitizer seen as a source for improper code sanitization
3030
*/
3131
class HtmlSanitizerCallAsSource extends Source {
3232
HtmlSanitizerCallAsSource() { this instanceof HtmlSanitizerCall }

‎javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeJQueryPluginCustomizations.qll‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ module UnsafeJQueryPlugin {
3232
abstract class Sanitizer extends DataFlow::Node { }
3333

3434
/**
35-
* An argument that may act as a HTML fragment rather than a CSS selector, as a sink for remote unsafe jQuery plugins.
35+
* An argument that may act as an HTML fragment rather than a CSS selector, as a sink for remote unsafe jQuery plugins.
3636
*/
3737
class AmbiguousHtmlOrSelectorArgument extends DataFlow::Node,
3838
DomBasedXss::JQueryHtmlOrSelectorArgument {
@@ -173,7 +173,7 @@ module UnsafeJQueryPlugin {
173173
}
174174

175175
/**
176-
* An argument that may act as a HTML fragment rather than a CSS selector, as a sink for remote unsafe jQuery plugins.
176+
* An argument that may act as an HTML fragment rather than a CSS selector, as a sink for remote unsafe jQuery plugins.
177177
*/
178178
class AmbiguousHtmlOrSelectorArgumentAsSink extends Sink {
179179
AmbiguousHtmlOrSelectorArgumentAsSink() {
@@ -182,7 +182,7 @@ module UnsafeJQueryPlugin {
182182
}
183183

184184
/**
185-
* A hint that a value is expected to be treated as a HTML fragment later.
185+
* A hint that a value is expected to be treated as an HTML fragment later.
186186
*/
187187
class IntentionalHtmlFragmentHint extends Sanitizer {
188188
IntentionalHtmlFragmentHint() {
@@ -191,7 +191,7 @@ module UnsafeJQueryPlugin {
191191
}
192192

193193
/**
194-
* Holds if there exists a jQuery plugin that likely expects `sink` to be treated as a HTML fragment.
194+
* Holds if there exists a jQuery plugin that likely expects `sink` to be treated as an HTML fragment.
195195
*/
196196
predicate isLikelyIntentionalHtmlSink(DataFlow::Node sink) {
197197
exists(
@@ -206,7 +206,7 @@ module UnsafeJQueryPlugin {
206206
}
207207

208208
/**
209-
* Gets a property-write that writes a HTML-like constant string to `prop`.
209+
* Gets a property-write that writes an HTML-like constant string to `prop`.
210210
*/
211211
pragma[noinline]
212212
private DataFlow::PropWrite getALikelyHtmlWrite(string prop) {

‎javascript/ql/lib/semmle/javascript/security/dataflow/Xss.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ module Shared {
6565
private import semmle.javascript.security.dataflow.IncompleteHtmlAttributeSanitizationCustomizations::IncompleteHtmlAttributeSanitization as IncompleteHtml
6666

6767
/**
68-
* A guard that checks if a string can contain quotes, which is a guard for strings that are inside a HTML attribute.
68+
* A guard that checks if a string can contain quotes, which is a guard for strings that are inside an HTML attribute.
6969
*/
7070
abstract class QuoteGuard extends TaintTracking::SanitizerGuardNode, StringOps::Includes {
7171
QuoteGuard() {

‎javascript/ql/src/Security/CWE-079/UnsafeHtmlConstruction.qhelp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@
4444
<sample src="examples/unsafe-html-construction_safe.js" />
4545

4646
<p>
47-
Alternatively, a HTML sanitizer can be used to remove unsafe content.
47+
Alternatively, an HTML sanitizer can be used to remove unsafe content.
4848
</p>
4949

5050
<sample src="examples/unsafe-html-construction_sanitizer.js" />

‎javascript/ql/src/Security/CWE-094/ImproperCodeSanitization.qhelp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212

1313
<recommendation>
1414
<p>
15-
If using <code>JSON.stringify</code> or a HTML sanitizer to sanitize a string inserted into
15+
If using <code>JSON.stringify</code> or an HTML sanitizer to sanitize a string inserted into
1616
JavaScript code, then make sure to perform additional sanitization or remove potentially
1717
dangerous characters.
1818
</p>

‎javascript/ql/test/query-tests/Security/CWE-116/BadTagFilter/BadTagFilter.expected‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,5 +13,5 @@
1313
| tst.js:18:6:18:48 | <(?:!--([\\S\|\\s]*?)-->)\|([^\\/\\s>]+)[\\S\\s]*?> | Comments ending with --> are matched differently from comments ending with --!>. The first is matched with capture group 1 and comments ending with --!> are matched with capture group 2. |
1414
| tst.js:19:6:19:147 | <(?:(?:\\/([^>]+)>)\|(?:!--([\\S\|\\s]*?)-->)\|(?:([^\\/\\s>]+)((?:\\s+[\\w\\-:.]+(?:\\s*=\\s*?(?:(?:"[^"]*")\|(?:'[^']*')\|[^\\s"'\\/>]+))?)*)[\\S\\s]*?(\\/?)>)) | Comments ending with --> are matched differently from comments ending with --!>. The first is matched with capture group 2 and comments ending with --!> are matched with capture group 3, 4. |
1515
| tst.js:20:3:20:57 | (<[a-z\\/!$]("[^"]*"\|'[^']*'\|[^'">])*>\|<!(--.*?--\\s*)+>) | Comments ending with --> are matched differently from comments ending with --!>. The first is matched with capture group 3 and comments ending with --!> are matched with capture group 1. |
16-
| tst.js:21:6:21:249 | <(?:(?:!--([\\w\\W]*?)-->)\|(?:!\\[CDATA\\[([\\w\\W]*?)\\]\\]>)\|(?:!DOCTYPE([\\w\\W]*?)>)\|(?:\\?([^\\s\\/<>]+) ?([\\w\\W]*?)[?/]>)\|(?:\\/([A-Za-z][A-Za-z0-9\\-_\\:\\.]*)>)\|(?:([A-Za-z][A-Za-z0-9\\-_\\:\\.]*)((?:\\s+[^"'>]+(?:(?:"[^"]*")\|(?:'[^']*')\|[^>]*))*\|\\/\|\\s+)>)) | This regular expression only parses --> (capture group 1) and not --!> as a HTML comment end tag. |
16+
| tst.js:21:6:21:249 | <(?:(?:!--([\\w\\W]*?)-->)\|(?:!\\[CDATA\\[([\\w\\W]*?)\\]\\]>)\|(?:!DOCTYPE([\\w\\W]*?)>)\|(?:\\?([^\\s\\/<>]+) ?([\\w\\W]*?)[?/]>)\|(?:\\/([A-Za-z][A-Za-z0-9\\-_\\:\\.]*)>)\|(?:([A-Za-z][A-Za-z0-9\\-_\\:\\.]*)((?:\\s+[^"'>]+(?:(?:"[^"]*")\|(?:'[^']*')\|[^>]*))*\|\\/\|\\s+)>)) | This regular expression only parses --> (capture group 1) and not --!> as an HTML comment end tag. |
1717
| tst.js:22:6:22:33 | <!--([\\w\\W]*?)-->\|<([^>]*?)> | Comments ending with --> are matched differently from comments ending with --!>. The first is matched with capture group 1 and comments ending with --!> are matched with capture group 2. |

0 commit comments

Comments
 (0)