changes to address reviews

Author: erik-krogh

python/ql/src/Security/CWE-020/IncompleteUrlSubstringSanitization.ql

@@ -51,4 +51,5 @@ predicate unsafe_call_to_endswith(Call sanitizer, StrConst url) {
 
 from Expr sanitizer, StrConst url
 where incomplete_sanitization(sanitizer, url)
-select sanitizer, "$@ may be at an arbitrary position in the sanitized URL.", url, url.getText()
+select sanitizer, "The string $@ may be at an arbitrary position in the sanitized URL.", url,
+  url.getText()

python/ql/src/Security/CWE-209/StackTraceExposure.ql

@@ -19,5 +19,6 @@ import DataFlow::PathGraph
 
 from Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "This information exposed to the user depends on $@.",
-  source.getNode(), "stack trace information"
+select sink.getNode(), source, sink,
+  "$@ flows to this location and may be exposed to an external user.", source.getNode(),
+  "stack trace information"

python/ql/src/Security/CWE-295/RequestWithoutValidation.ql

@@ -24,4 +24,4 @@ where
   // value from.
   if disablingNode = origin then ending = "." else ending = " by $@."
 select request, "This request may run without certificate validation because $@" + ending,
-  disablingNode, "the request is disabled", origin, "this value"
+  disablingNode, "it is disabled", origin, "this value"

python/ql/src/Security/CWE-312/CleartextLogging.ql

@@ -22,5 +22,5 @@ from Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink, s
 where
   config.hasFlowPath(source, sink) and
   classification = source.getNode().(Source).getClassification()
-select sink.getNode(), source, sink, "This logs sensitive data returned by $@ as clear text.",
-  source.getNode(), "Sensitive data (" + classification + ")"
+select sink.getNode(), source, sink, "This expression logs $@ as clear text.", source.getNode(),
+  "sensitive data (" + classification + ")"

python/ql/src/Security/CWE-312/CleartextStorage.ql

@@ -22,5 +22,5 @@ from Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink, s
 where
   config.hasFlowPath(source, sink) and
   classification = source.getNode().(Source).getClassification()
-select sink.getNode(), source, sink, "This stores $@ as clear text.", source.getNode(),
-  "Sensitive data (" + classification + ")"
+select sink.getNode(), source, sink, "This expression stores $@ as clear text.", source.getNode(),
+  "sensitive data (" + classification + ")"

python/ql/src/Security/CWE-730/RegexInjection.ql

@@ -24,5 +24,6 @@ from
 where
   config.hasFlowPath(source, sink) and
   regexExecution = sink.getNode().(Sink).getRegexExecution()
-select sink.getNode(), source, sink, "This regular expression depends on a $@ and executed by $@.",
-  source.getNode(), "user-provided value", regexExecution, regexExecution.getName()
+select sink.getNode(), source, sink,
+  "This regular expression depends on a $@ and is executed by $@.", source.getNode(),
+  "user-provided value", regexExecution, regexExecution.getName()

python/ql/src/Security/CWE-798/HardcodedCredentials.ql

@@ -129,5 +129,5 @@ from HardcodedCredentialsConfiguration config, TaintedPathSource src, TaintedPat
 where
   config.hasFlowPath(src, sink) and
   not any(TestScope test).contains(src.getAstNode())
-select sink.getSink(), src, sink, "This hardcoded value is $@.", sink.getNode(),
+select src.getSource(), src, sink, "This hardcoded value is $@.", sink.getNode(),
   "used as credentials"

python/ql/src/Statements/NonIteratorInForLoop.ql

@@ -22,4 +22,5 @@ where
   not t.failedInference(_) and
   not v = Value::named("None") and
   not t.isDescriptorType()
-select loop, "$@ of class $@ may be used in for-loop.", origin, "Non-iterable", t, t.getName()
+select loop, "This for-loop may attempt to iterate over a $@ of class $@.", origin,
+  "non-iterable instance", t, t.getName()

python/ql/src/Variables/MultiplyDefined.ql

@@ -67,5 +67,5 @@ where
   forall(Name el | el = asgn1.getParentNode().(Tuple).getAnElt() | multiply_defined(el, _, _)) and
   not uninteresting_definition(asgn1)
 select asgn1,
-  "This assignment to '" + v.getId() + "' is unnecessary as $@ before this value is used.", asgn2,
-  "it is redefined"
+  "This assignment to '" + v.getId() + "' is unnecessary as it is $@ before this value is used.",
+  asgn2, "redefined"

python/ql/src/experimental/Security/CWE-022/ZipSlip.ql

@@ -19,5 +19,5 @@ import DataFlow::PathGraph
 from ZipSlipConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)
 select source.getNode(), source, sink,
-  "Unsanitized archive entry, which may contain '..', is used in a $@.", sink.getNode(),
+  "This unsanitized archive entry, which may contain '..', is used in a $@.", sink.getNode(),
   "file system operation"