Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Commit ee43565

Browse files
Apply suggestions from code review
Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com>
1 parent fb78818 commit ee43565

2 files changed

Lines changed: 6 additions & 6 deletions

File tree

ql/src/experimental/CWE-352/ConstantOauth2State.qhelp

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@
44
<qhelp>
55
<overview>
66
<p>
7-
Oauth2 clients must implement CSRF protection for the redirection URI, which is typically accomplished by including a "state" value that binds the request to
8-
the user's authenticated state. The Go Oauth2 library allows to specify a "state" value which is then included in the auth code URL, and then provided back by the remote authentication server in the redirect callback, from where it must be validated; failure to do so makes the client susceptible to an CSRF attack.
7+
OAuth 2.0 clients must implement CSRF protection for the redirection URI, which is typically accomplished by including a "state" value that binds the request to
8+
the user's authenticated state. The Go OAuth 2.0 library allows to specify a "state" value which is then included in the auth code URL, and then provided back by the remote authentication server in the redirect callback, from where it must be validated; failure to do so makes the client susceptible to an CSRF attack.
99
</p>
1010
</overview>
1111
<recommendation>
@@ -23,4 +23,4 @@
2323
</p>
2424
<sample src="ConstantOauth2StateBetter.go" />
2525
</example>
26-
</qhelp>
26+
</qhelp>

ql/src/experimental/CWE-352/ConstantOauth2State.ql

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/**
2-
* @name Use of constant `state` value in Oauth2 URL.
3-
* @description Using a constant value for the `state` in the oauth2 URL makes the application
2+
* @name Use of constant `state` value in OAuth 2.0 URL.
3+
* @description Using a constant value for the `state` in the OAuth 2.0 URL makes the application
44
* susceptible to CSRF attacks.
55
* @kind path-problem
66
* @problem.severity error
@@ -14,7 +14,7 @@ import DataFlow::PathGraph
1414

1515
/**
1616
* A method that creates a new URL that will send the user
17-
* to the oauth2 authorization dialog of the provider.
17+
* to the OAuth 2.0 authorization dialog of the provider.
1818
*/
1919
class AuthCodeURL extends Method {
2020
AuthCodeURL() { this.hasQualifiedName("golang.org/x/oauth2", "Config", "AuthCodeURL") }

0 commit comments

Comments
 (0)