We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
There was an error while loading. Please reload this page.
1 parent aa19fe6 commit e387d60Copy full SHA for e387d60
csharp/ql/src/Input Validation/ValueShadowing.qhelp
@@ -5,8 +5,8 @@
5
<overview>
6
<p>Relying on <code>HttpRequest</code> to provide access to a particular client variable is not
7
safe. The <code>HttpRequest</code> class implements an indexer to provide a simplified, combined
8
-access to its <code>QueryString</code>, <code>Form</code>, <code>Cookies</code>, or <code>
9
-ServerVariables</code> collections, in that particular order. When searching for a variable, the
+access to its <code>QueryString</code>, <code>Form</code>, <code>Cookies</code>, or
+<code>ServerVariables</code> collections, in that particular order. When searching for a variable, the
10
first match is returned: <code>QueryString</code> parameters hence supersede values from forms,
11
cookies and server variables, and so on. This is a serious attack vector since an attacker could
12
inject a value in the query string that you do not expect, and which supersedes the value of a more
0 commit comments