@@ -233,7 +233,7 @@ In this example, we'll show how to add the following SQL injection sink using a
233233 conn.query(q, (err, rows) => {...}); // <-- add 'q' as a SQL injection sink
234234 });
235235
236- We can recognize this using a fuzzy model, as showin in the following extension:
236+ We can recognize this using a fuzzy model, as shown in the following extension:
237237
238238.. code-block :: yaml
239239
@@ -244,13 +244,13 @@ We can recognize this using a fuzzy model, as showin in the following extension:
244244 data :
245245 - ["mysql", "Fuzzy.Member[query].Argument[0]", "sql-injection"]
246246
247- - The first column, **"mysql" **, begins the search at at places where the `mysql ` package is imported.
247+ - The first column, **"mysql" **, begins the search at places where the `mysql ` package is imported.
248248- **Fuzzy ** selects all objects that appear to originate from the `mysql ` package, such as the `pool `, `conn `, `err `, and `rows ` objects.
249249- **Member[query] ** selects the **query ** member from any of those objects. In this case, the only such member is `conn.query `.
250250 In principle, this would also find expressions such as `pool.query ` and `err.query `, but in practice such expressions
251251 are not likely to occur, because the `pool ` and `err ` objects do not have a member named `query `.
252252- **Argument[0] ** selects the first argument of a call to the selected member, that is, the `q ` argument to `conn.query `.
253- - **sql-injection ** indicates that this is considered a sink for the SQL injection query.
253+ - **sql-injection ** indicates that this is considered as a sink for the SQL injection query.
254254
255255For reference, a more detailed model might look like this, as described in the preceding examples:
256256
@@ -485,7 +485,7 @@ The following components are supported:
485485- **Awaited ** selects the value of a promise.
486486- **Instance ** selects instances of a class.
487487- **Fuzzy ** selects all values that are derived from the current value through a combination of the other operations described in this list.
488- For example, this can be used to find all values the appear to originate from a particular package. This can be useful for finding method calls
488+ For example, this can be used to find all values that appear to originate from a particular package. This can be useful for finding method calls
489489 from a known package, but where the receiver type is not known or is difficult to model.
490490
491491The following components are called "call site filters". They select a subset of the previously-selected calls, if the call fits certain criteria:
0 commit comments