Skip to content

Python : Add support for detecting XSLT Injection #3521

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ghost wants to merge 4 commits into from
Closed

Python : Add support for detecting XSLT Injection #3521

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1ceb963
Python : Add support for detecting XSLT Injection
May 19, 2020
6dd9106
Update XSLT.qll
Jun 7, 2020
33a9fb6
Python: Reorder XSLT qhelp to be valid
RasmusWL Jun 11, 2020
a24974b
Python: Add missing <p> to qhelp
RasmusWL Jun 11, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Python: Reorder XSLT qhelp to be valid
  • Loading branch information
@RasmusWL
RasmusWL authored Jun 11, 2020
commit 33a9fb6034b3a58bc273abe926d5f30d9667d12b
10 changes: 5 additions & 5 deletions python/ql/src/experimental/CWE-643/Xslt.qhelp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,9 @@
This vulnerability can be prevented by not allowing untrusted user input to be passed as a XSL stylesheet.
If the application logic necessiates processing untrusted XSL stylesheets, the input should be properly filtered and sanitized before use.
</p>
<example>
<p>In the example below, the XSL stylesheet is controlled by the user and hence leads to a vulnerability.</p>
<sample src="xslt.py" />
</example>
</recommendation>
</qhelp>
<example>
<p>In the example below, the XSL stylesheet is controlled by the user and hence leads to a vulnerability.</p>
<sample src="xslt.py" />
</example>
</qhelp>