Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Commit 223d0db

Browse files
author
Max Schaefer
committed
Fix missing </p> in qhelp.
1 parent bccf750 commit 223d0db

1 file changed

Lines changed: 6 additions & 5 deletions

File tree

ql/src/experimental/CWE-807/SensitiveConditionBypass.qhelp

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,25 +6,26 @@ Testing untrusted user input against a fixed constant results in
66
a bypass of the conditional check as the attacker may alter the input to match the constant.
77
When an incorrect check of this type is used to guard a potentially sensitive block,
88
it results an attacker gaining access to the sensitive block.
9-
</p>
9+
</p>
1010
</overview>
1111
<recommendation>
1212
<p>
1313
Never decide whether to authenticate a user based on data that may be controlled by that user.
1414
If necessary, ensure that the data is validated extensively when it is input before any
1515
authentication checks are performed.
16-
</p>
17-
<p>
16+
</p>
17+
<p>
1818
It is still possible to have a system that "remembers" users, thus not requiring
1919
the user to login on every interaction. For example, personalization settings can be applied
2020
without authentication because this is not sensitive information. However, users
21-
should be allowed to take sensitive actions only when they have been fully authenticated.
21+
should be allowed to take sensitive actions only when they have been fully authenticated.
22+
</p>
2223
</recommendation>
2324
<example>
2425
<p>
2526
The following example shows a comparison where an user controlled
2627
expression is used to guard a sensitive method. This should be avoided.:
27-
</p>
28+
</p>
2829
<sample src="SensitiveConditionBypassBad.go" />
2930
</example>
3031
</qhelp>

0 commit comments

Comments
 (0)