You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: python/ql/src/experimental/CWE-074/TemplateInjection.qhelp
+2-2
Original file line number
Diff line number
Diff line change
@@ -13,10 +13,10 @@
13
13
</recommendation>
14
14
<example>
15
15
<p>Consider the example given below, an untrusted HTTP parameter `template` is used to generate a Jinja2 template string. This can lead to remote code execution. </p>
16
-
<samplesrc="jinjaBad.py" />
16
+
<samplesrc="JinjaBad.py" />
17
17
18
18
<p>Here we have fixed the problem by using the Jinja sandbox environment for evaluating untrusted code.</p>
19
-
<samplesrc="jinjaGood.py" />
19
+
<samplesrc="JinjaGood.py" />
20
20
</example>
21
21
<references>
22
22
<li>Portswigger : [Server Side Template Injection](https://portswigger.net/web-security/server-side-template-injection)</li>
0 commit comments