From c6a71cd3fd475f7bd9f7128eb0fe059d43299787 Mon Sep 17 00:00:00 2001 From: Jami Cogswell Date: Wed, 5 Feb 2025 10:20:57 -0500 Subject: [PATCH] Java: minor qhelp updates --- .../src/Security/CWE/CWE-352/CsrfUnprotectedRequestType.qhelp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/java/ql/src/Security/CWE/CWE-352/CsrfUnprotectedRequestType.qhelp b/java/ql/src/Security/CWE/CWE-352/CsrfUnprotectedRequestType.qhelp index 8555a37f9408..137243c3f5ba 100644 --- a/java/ql/src/Security/CWE/CWE-352/CsrfUnprotectedRequestType.qhelp +++ b/java/ql/src/Security/CWE/CWE-352/CsrfUnprotectedRequestType.qhelp @@ -10,7 +10,7 @@

The attacker tricks an authenticated user into submitting a request to the - web application. Typically this request will result in a state change on + web application. Typically, this request will result in a state change on the server, such as changing the user's password. The request can be initiated when the user visits a site controlled by the attacker. If the web application relies only on cookies for authentication, or on other @@ -51,7 +51,7 @@ application state. Instead, use the POST method which Stapler defau

  • OWASP: -Cross-Site Request Forgery (CSRF). +Cross Site Request Forgery (CSRF).
  • Spring Security Reference: