From 6febd2245ae4a9992b48ba11636777d0e3bacc7a Mon Sep 17 00:00:00 2001 From: daniel-teuchert-sonarsource <141642369+daniel-teuchert-sonarsource@users.noreply.github.com> Date: Tue, 21 Nov 2023 15:59:01 +0100 Subject: [PATCH] Modify rule S5148: Adjust code example format (#3454) --- rules/S5148/html/rule.adoc | 6 ++++-- rules/S5148/javascript/rule.adoc | 3 ++- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/rules/S5148/html/rule.adoc b/rules/S5148/html/rule.adoc index 181b8e32dc3..c6579516d85 100644 --- a/rules/S5148/html/rule.adoc +++ b/rules/S5148/html/rule.adoc @@ -6,6 +6,7 @@ include::../recommended.adoc[] == Sensitive Code Example +[source,html] ---- @@ -18,15 +19,16 @@ To prevent pages from abusing ``++window.opener++``, use ``++rel=noopener++`` on [source,html] ---- - + ---- == Exceptions No Issue will be raised when ``++href++`` contains a hardcoded relative url as there it has less chances of being vulnerable. An url is considered hardcoded and relative if it doesn't start with ``++http://++`` or ``++https://++``, and if it does not contain any of the characters {}$()[] +[source,html] ---- - + ---- include::../see.adoc[] diff --git a/rules/S5148/javascript/rule.adoc b/rules/S5148/javascript/rule.adoc index b73d27c34bd..a2aeab605f8 100644 --- a/rules/S5148/javascript/rule.adoc +++ b/rules/S5148/javascript/rule.adoc @@ -6,8 +6,9 @@ include::../recommended.adoc[] == Sensitive Code Example +[source,javascript] ---- -window.open("https://example.com/dangerous"); +window.open("https://example.com/dangerous"); // Sensitive ---- == Compliant Solution