From c4eb6f0056ab56d9feb9fb05c008418895997cb5 Mon Sep 17 00:00:00 2001
From: Bas van Schaik <github@s.traiectum.net>
Date: Tue, 2 Oct 2018 14:47:52 +0100
Subject: [PATCH] fix JS example based on LGTM.com alerts

https://lgtm.com/projects/g/Semmle/ql/snapshot/1f7ef5b0d7706803f73e97d2294a60c02f4bd511/files/javascript/ql/src/Security/CWE-079/examples/StoredXssGood.js#x95b0280fcab9007a:1
https://lgtm.com/projects/g/Semmle/ql/snapshot/1f7ef5b0d7706803f73e97d2294a60c02f4bd511/files/javascript/ql/src/Security/CWE-079/examples/StoredXss.js#xaef03a63aa3e02e4:1
---
 javascript/ql/src/Security/CWE-079/examples/StoredXss.js     | 2 +-
 javascript/ql/src/Security/CWE-079/examples/StoredXssGood.js | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/javascript/ql/src/Security/CWE-079/examples/StoredXss.js b/javascript/ql/src/Security/CWE-079/examples/StoredXss.js
index 226cdced23d3..fe3c76ff1452 100644
--- a/javascript/ql/src/Security/CWE-079/examples/StoredXss.js
+++ b/javascript/ql/src/Security/CWE-079/examples/StoredXss.js
@@ -6,7 +6,7 @@ express().get('/list-directory', function(req, res) {
         var list = '<ul>';
         fileNames.forEach(fileName => {
             // BAD: `fileName` can contain HTML elements
-            list += '<li>' + fileName '</li>';
+            list += '<li>' + fileName + '</li>';
         });
         list += '</ul>'
         res.send(list);
diff --git a/javascript/ql/src/Security/CWE-079/examples/StoredXssGood.js b/javascript/ql/src/Security/CWE-079/examples/StoredXssGood.js
index 0a05c3a7d452..c7e9966c72fc 100644
--- a/javascript/ql/src/Security/CWE-079/examples/StoredXssGood.js
+++ b/javascript/ql/src/Security/CWE-079/examples/StoredXssGood.js
@@ -7,7 +7,7 @@ express().get('/list-directory', function(req, res) {
         var list = '<ul>';
         fileNames.forEach(fileName => {
             // GOOD: escaped `fileName` can not contain HTML elements
-            list += '<li>' + escape(fileName) '</li>';
+            list += '<li>' + escape(fileName) + '</li>';
         });
         list += '</ul>'
         res.send(list);