Update documentation

Author: joefarebrother

python/ql/src/Security/CWE-1004/NonHttpOnlyCookie.qhelp

@@ -6,7 +6,7 @@
 <overview>
 <p>Cookies without the <code>HttpOnly</code> flag set are accessible to JavaScript running in the same origin. 
 In case of a Cross-Site Scripting (XSS) vulnerability, the cookie can be stolen by a malicious script.
-If a cookie does not need to be accessed directly by client-side JS, the <code>HttpOnly</code> flag should be set.</p>
+If a sensitive cookie does not need to be accessed directly by client-side JS, the <code>HttpOnly</code> flag should be set.</p>
 </overview>
 
 <recommendation>

python/ql/src/Security/CWE-1004/examples/InsecureCookie.py

@@ -4,18 +4,18 @@
 @app.route("/good1")
 def good1():
     resp = make_response()
-    resp.set_cookie("name", value="value", secure=True, httponly=True, samesite='Strict') # GOOD: Attributes are securely set
+    resp.set_cookie("sessionid", value="value", secure=True, httponly=True, samesite='Strict') # GOOD: Attributes are securely set
     return resp
 
 
 @app.route("/good2")
 def good2():
     resp = make_response()
-    resp.headers['Set-Cookie'] = "name=value; Secure; HttpOnly; SameSite=Strict" # GOOD: Attributes are securely set 
+    resp.headers['Set-Cookie'] = "sessionid=value; Secure; HttpOnly; SameSite=Strict" # GOOD: Attributes are securely set 
     return resp
 
 @app.route("/bad1")
 def bad1():
     resp = make_response()
-    resp.set_cookie("name", value="value", samesite='None') # BAD: the SameSite attribute is set to 'None' and the 'Secure' and 'HttpOnly' attributes are set to False by default.
+    resp.set_cookie("sessionid", value="value", samesite='None') # BAD: the SameSite attribute is set to 'None' and the 'Secure' and 'HttpOnly' attributes are set to False by default.
     return resp

python/ql/src/Security/CWE-1275/SameSiteNoneCookie.qhelp

@@ -5,7 +5,7 @@
 
 <overview>
 <p>Cookies with the <code>SameSite</code> attribute set to <code>'None'</code> will be sent with cross-origin requests. 
-This can sometimes allow for Cross-Site Request Forgery (CSRF) attacks, in which a third-party site could perform actions on behalf of a user.</p>
+This can sometimes allow for Cross-Site Request Forgery (CSRF) attacks, in which a third-party site could perform actions on behalf of a user, if the cookie is used for authentication.</p>
 </overview>
 
 <recommendation>

python/ql/src/Security/CWE-1275/examples/InsecureCookie.py

@@ -4,18 +4,18 @@
 @app.route("/good1")
 def good1():
     resp = make_response()
-    resp.set_cookie("name", value="value", secure=True, httponly=True, samesite='Strict') # GOOD: Attributes are securely set
+    resp.set_cookie("sessionid", value="value", secure=True, httponly=True, samesite='Strict') # GOOD: Attributes are securely set
     return resp
 
 
 @app.route("/good2")
 def good2():
     resp = make_response()
-    resp.headers['Set-Cookie'] = "name=value; Secure; HttpOnly; SameSite=Strict" # GOOD: Attributes are securely set 
+    resp.headers['Set-Cookie'] = "sessionid=value; Secure; HttpOnly; SameSite=Strict" # GOOD: Attributes are securely set 
     return resp
 
 @app.route("/bad1")
 def bad1():
     resp = make_response()
-    resp.set_cookie("name", value="value", samesite='None') # BAD: the SameSite attribute is set to 'None' and the 'Secure' and 'HttpOnly' attributes are set to False by default.
+    resp.set_cookie("sessionid", value="value", samesite='None') # BAD: the SameSite attribute is set to 'None' and the 'Secure' and 'HttpOnly' attributes are set to False by default.
     return resp

python/ql/src/Security/CWE-614/examples/InsecureCookie.py

@@ -4,18 +4,18 @@
 @app.route("/good1")
 def good1():
     resp = make_response()
-    resp.set_cookie("name", value="value", secure=True, httponly=True, samesite='Strict') # GOOD: Attributes are securely set
+    resp.set_cookie("sessionid", value="value", secure=True, httponly=True, samesite='Strict') # GOOD: Attributes are securely set
     return resp
 
 
 @app.route("/good2")
 def good2():
     resp = make_response()
-    resp.headers['Set-Cookie'] = "name=value; Secure; HttpOnly; SameSite=Strict" # GOOD: Attributes are securely set 
+    resp.headers['Set-Cookie'] = "sessionid=value; Secure; HttpOnly; SameSite=Strict" # GOOD: Attributes are securely set 
     return resp
 
 @app.route("/bad1")
 def bad1():
     resp = make_response()
-    resp.set_cookie("name", value="value", samesite='None') # BAD: the SameSite attribute is set to 'None' and the 'Secure' and 'HttpOnly' attributes are set to False by default.
+    resp.set_cookie("sessionid", value="value", samesite='None') # BAD: the SameSite attribute is set to 'None' and the 'Secure' and 'HttpOnly' attributes are set to False by default.
     return resp