Inline qhelp overview

A <p> at the top isn't allowed, and for some reason the inclusion is required to be a valid qhelp file.

Author: smowton

java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.qhelp

@@ -3,7 +3,10 @@
   "qhelp.dtd">
 <qhelp>
 <overview>
-<include src="PartialPathTraversalOverview.inc.qhelp"/> 
+<p>A common way to check that a user-supplied path <code>SUBDIR</code> falls inside a directory <code>DIR</code>
+is to use <code>getCanonicalPath()</code> to remove any path-traversal elements and then check that <code>DIR</code>
+is a prefix. However, if <code>DIR</code> is not slash-terminated, this can unexpectedly allow accessing siblings of <code>DIR</code>.</p>
+
 <p>See also <code>java/partial-path-traversal-from-remote</code>, which is similar to this query but only flags instances with evidence of remote exploitability</p>
 </overview>
 

java/ql/src/Security/CWE/CWE-023/PartialPathTraversalFromRemote.qhelp

@@ -3,7 +3,10 @@
   "qhelp.dtd">
 <qhelp>
 <overview>
-<include src="PartialPathTraversalOverview.inc.qhelp"/> 
+<p>A common way to check that a user-supplied path <code>SUBDIR</code> falls inside a directory <code>DIR</code>
+is to use <code>getCanonicalPath()</code> to remove any path-traversal elements and then check that <code>DIR</code>
+is a prefix. However, if <code>DIR</code> is not slash-terminated, this can unexpectedly allow accessing siblings of <code>DIR</code>.</p>
+
 <p>See also <code>java/partial-path-traversal</code>, which is similar to this query, 
 but may also flag non-remotely-exploitable instances of Partial Path Traversal.</p>
 </overview>