changed to address review

Author: erik-krogh

csharp/ql/campaigns/Solorigate/src/ModifiedFnvFunctionDetection.ql

@@ -27,5 +27,5 @@ where
       xor2.getAnOperand() = v.getAnAccess()
     )
   )
-select l, "This literal is used in an $@ after a FNV-like hash calculation with variable $@.",
+select l, "This literal is used in an $@ after an FNV-like hash calculation with variable $@.",
   additional_xor, "additional xor", v, v.toString()

csharp/ql/campaigns/Solorigate/src/NumberOfKnownMethodNamesAboveThreshold.ql

@@ -28,5 +28,5 @@ where
   isSolorigateSuspiciousMethodName(m) and
   total > threshold
 select m,
-  "This method " + m.getName() + " may be related to Solorigate. Total count = " + total +
-    " is above the threshold " + threshold + "."
+  "This method may be related to Solorigate. Total count = " + total + " is above the threshold " +
+    threshold + "."

csharp/ql/src/Security Features/CWE-078/StoredCommandInjection.ql

@@ -25,4 +25,4 @@ class StoredTaintTrackingConfiguration extends TaintTrackingConfiguration {
 from StoredTaintTrackingConfiguration c, DataFlow::PathNode source, DataFlow::PathNode sink
 where c.hasFlowPath(source, sink)
 select sink.getNode(), source, sink, "Command line depends on a $@.", source.getNode(),
-  "stored user-provided value"
+  "stored (potentially user-provided) value"

csharp/ql/src/Security Features/CWE-079/StoredXSS.ql

@@ -32,4 +32,4 @@ where
   then explanation = " (" + sink.getNode().(Sink).explanation() + ")"
   else explanation = ""
 select sink.getNode(), source, sink, "HTML or JavaScript write" + explanation + " depends on a $@.",
-  source.getNode(), "stored user-provided value"
+  source.getNode(), "stored (potentially user-provided) value"

csharp/ql/src/Security Features/CWE-090/StoredLDAPInjection.ql

@@ -23,4 +23,4 @@ class StoredTaintTrackingConfiguration extends TaintTrackingConfiguration {
 from StoredTaintTrackingConfiguration c, DataFlow::PathNode source, DataFlow::PathNode sink
 where c.hasFlowPath(source, sink)
 select sink.getNode(), source, sink, "This LDAP query depends on a $@.", source.getNode(),
-  "stored user-provided value"
+  "stored (potentially user-provided) value"

csharp/ql/src/Security Features/CWE-134/UncontrolledFormatString.ql

@@ -39,5 +39,5 @@ string getSourceType(DataFlow::Node node) {
 
 from FormatStringConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "Format string depends on a $@.", source.getNode(),
+select sink.getNode(), source, sink, "Format string depends on $@.", source.getNode(),
   ("this" + getSourceType(source.getNode()))

csharp/ql/src/Security Features/CWE-643/StoredXPathInjection.ql

@@ -23,4 +23,4 @@ class StoredTaintTrackingConfiguration extends XPathInjection::TaintTrackingConf
 from StoredTaintTrackingConfiguration c, DataFlow::PathNode source, DataFlow::PathNode sink
 where c.hasFlowPath(source, sink)
 select sink.getNode(), source, sink, "XPath expression depends on a $@.", source.getNode(),
-  "stored user-provided value"
+  "stored (potentially user-provided) value"

csharp/ql/test/query-tests/Security Features/CWE-078/StoredCommandInjection.expected

@@ -5,4 +5,4 @@ nodes
 | StoredCommandInjection.cs:22:54:22:80 | call to method GetString : String | semmle.label | call to method GetString : String |
 subpaths
 #select
-| StoredCommandInjection.cs:22:46:22:80 | ... + ... | StoredCommandInjection.cs:22:54:22:80 | call to method GetString : String | StoredCommandInjection.cs:22:46:22:80 | ... + ... | Command line depends on a $@. | StoredCommandInjection.cs:22:54:22:80 | call to method GetString | stored user-provided value |
+| StoredCommandInjection.cs:22:46:22:80 | ... + ... | StoredCommandInjection.cs:22:54:22:80 | call to method GetString : String | StoredCommandInjection.cs:22:46:22:80 | ... + ... | Command line depends on a $@. | StoredCommandInjection.cs:22:54:22:80 | call to method GetString | stored (potentially user-provided) value |

csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/StoredXSS.expected

@@ -5,4 +5,4 @@ nodes
 | StoredXSS.cs:24:60:24:86 | call to method GetString : String | semmle.label | call to method GetString : String |
 subpaths
 #select
-| StoredXSS.cs:24:44:24:86 | ... + ... | StoredXSS.cs:24:60:24:86 | call to method GetString : String | StoredXSS.cs:24:44:24:86 | ... + ... | HTML or JavaScript write depends on a $@. | StoredXSS.cs:24:60:24:86 | call to method GetString | stored user-provided value |
+| StoredXSS.cs:24:44:24:86 | ... + ... | StoredXSS.cs:24:60:24:86 | call to method GetString : String | StoredXSS.cs:24:44:24:86 | ... + ... | HTML or JavaScript write depends on a $@. | StoredXSS.cs:24:60:24:86 | call to method GetString | stored (potentially user-provided) value |

csharp/ql/test/query-tests/Security Features/CWE-090/StoredLDAPInjection.expected

@@ -5,4 +5,4 @@ nodes
 | StoredLDAPInjection.cs:22:83:22:109 | call to method GetString : String | semmle.label | call to method GetString : String |
 subpaths
 #select
-| StoredLDAPInjection.cs:22:66:22:109 | ... + ... | StoredLDAPInjection.cs:22:83:22:109 | call to method GetString : String | StoredLDAPInjection.cs:22:66:22:109 | ... + ... | This LDAP query depends on a $@. | StoredLDAPInjection.cs:22:83:22:109 | call to method GetString | stored user-provided value |
+| StoredLDAPInjection.cs:22:66:22:109 | ... + ... | StoredLDAPInjection.cs:22:83:22:109 | call to method GetString : String | StoredLDAPInjection.cs:22:66:22:109 | ... + ... | This LDAP query depends on a $@. | StoredLDAPInjection.cs:22:83:22:109 | call to method GetString | stored (potentially user-provided) value |