From ff5a248b98103243f88c9d764763dbd4b19a8986 Mon Sep 17 00:00:00 2001
From: John Zabroski <johnzabroski@gmail.com>
Date: Mon, 24 Aug 2026 18:34:12 -0400
Subject: [PATCH 1/5] Correct 'enable' to 'enabled' in ASP.NET example

---
 .../CWE-548/ASPNetDirectoryListing.qhelp                  | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/csharp/ql/src/Security Features/CWE-548/ASPNetDirectoryListing.qhelp b/csharp/ql/src/Security Features/CWE-548/ASPNetDirectoryListing.qhelp
index f078ff574058..e03cf21a96f0 100644
--- a/csharp/ql/src/Security Features/CWE-548/ASPNetDirectoryListing.qhelp	
+++ b/csharp/ql/src/Security Features/CWE-548/ASPNetDirectoryListing.qhelp	
@@ -21,13 +21,13 @@ If this configuration may be used in production, remove the <code>directoryBrows
 <example>
 
 <p>
-The following example shows the <code>directoryBrowse</code> <code>enable</code> attribute set to true in a <code>Web.config</code> file for ASP.NET:
+The following example shows the <code>directoryBrowse</code> <code>enabled</code> attribute set to true in a <code>Web.config</code> file for ASP.NET:
 </p>
 
 <sample src="Web.config.bad" />
 
 <p>
-To fix this problem, the <code>enable</code> attribute should be set to <code>false</code>, or the <code>directoryBrowse</code> element should be removed completely:
+To fix this problem, the <code>enabled</code> attribute should be set to <code>false</code>, or the <code>directoryBrowse</code> element should be removed completely:
 </p>
 
 <sample src="Web.config.good" />
@@ -36,8 +36,8 @@ To fix this problem, the <code>enable</code> attribute should be set to <code>fa
 <references>
 
 <li>
-MSDN:
-<a href="https://msdn.microsoft.com/en-us/library/ms691327(v=vs.90).aspx">directoryBrowse element</a>.
+Microsoft Learn: 
+<a href="https://learn.microsoft.com/en-us/iis/configuration/system.webserver/directorybrowse#attributes">directoryBrowse element</a>.
 </li>
 
 

From c23b3a9e03c5ddbbd90e168225f99facb996fe6f Mon Sep 17 00:00:00 2001
From: John Zabroski <johnzabroski@gmail.com>
Date: Mon, 24 Aug 2026 18:37:25 -0400
Subject: [PATCH 2/5] Fix typo in directoryBrowse attribute

---
 csharp/ql/src/Security Features/CWE-548/Web.config.bad | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/csharp/ql/src/Security Features/CWE-548/Web.config.bad b/csharp/ql/src/Security Features/CWE-548/Web.config.bad
index 24f547103f82..172f4c9aa656 100644
--- a/csharp/ql/src/Security Features/CWE-548/Web.config.bad	
+++ b/csharp/ql/src/Security Features/CWE-548/Web.config.bad	
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="utf-8" ?>
 <configuration>
   <system.webServer>
-    <directoryBrowse enable="true"/>
+    <directoryBrowse enabled="true"/>
    ...
   </system.web>
-</configuration>
\ No newline at end of file
+</configuration>

From ada881e5460a777fb15a321efd640f16c1796a7b Mon Sep 17 00:00:00 2001
From: John Zabroski <johnzabroski@gmail.com>
Date: Mon, 24 Aug 2026 18:37:38 -0400
Subject: [PATCH 3/5] Fix directoryBrowse attribute from 'enable' to 'enabled'

---
 csharp/ql/src/Security Features/CWE-548/Web.config.good | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/csharp/ql/src/Security Features/CWE-548/Web.config.good b/csharp/ql/src/Security Features/CWE-548/Web.config.good
index 5c0566153c64..76ba2eb597d7 100644
--- a/csharp/ql/src/Security Features/CWE-548/Web.config.good	
+++ b/csharp/ql/src/Security Features/CWE-548/Web.config.good	
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="utf-8" ?>
 <configuration>
   <system.webServer>
-    <directoryBrowse enable="false"/>
+    <directoryBrowse enabled="false"/>
    ...
   </system.web>
-</configuration>
\ No newline at end of file
+</configuration>

From 7f4324512a4f92281368c4114e4e271009460b4f Mon Sep 17 00:00:00 2001
From: John Zabroski <johnzabroski@gmail.com>
Date: Mon, 24 Aug 2026 19:09:01 -0400
Subject: [PATCH 4/5] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 csharp/ql/src/Security Features/CWE-548/Web.config.good | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/csharp/ql/src/Security Features/CWE-548/Web.config.good b/csharp/ql/src/Security Features/CWE-548/Web.config.good
index 76ba2eb597d7..b2d3258c5d05 100644
--- a/csharp/ql/src/Security Features/CWE-548/Web.config.good	
+++ b/csharp/ql/src/Security Features/CWE-548/Web.config.good	
@@ -3,5 +3,5 @@
   <system.webServer>
     <directoryBrowse enabled="false"/>
    ...
-  </system.web>
+  </system.webServer>
 </configuration>

From 748fbc7a11830dab9b9c9ca0700949c59ee5f634 Mon Sep 17 00:00:00 2001
From: John Zabroski <johnzabroski@gmail.com>
Date: Mon, 24 Aug 2026 19:11:19 -0400
Subject: [PATCH 5/5] Fix closing tag

---
 csharp/ql/src/Security Features/CWE-548/Web.config.bad | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/csharp/ql/src/Security Features/CWE-548/Web.config.bad b/csharp/ql/src/Security Features/CWE-548/Web.config.bad
index 172f4c9aa656..0d579a8d9a06 100644
--- a/csharp/ql/src/Security Features/CWE-548/Web.config.bad	
+++ b/csharp/ql/src/Security Features/CWE-548/Web.config.bad	
@@ -3,5 +3,5 @@
   <system.webServer>
     <directoryBrowse enabled="true"/>
    ...
-  </system.web>
+  </system.webServer>
 </configuration>