Reword

Author: smowton

ruby/ql/src/queries/security/cwe-352/CSRFProtectionDisabled.qhelp

@@ -61,8 +61,8 @@
       Note this remains true even in Rails version 5 and later: these versions
       automatically run <code>protect_from_forgery with: :exception</code>
       by default, but manually calling <code>protect_from_forgery</code> with
-      no <code>with</code> argument will still downgrade protection to null the
-      session rather than raise an exception.
+      no <code>with</code> argument will still downgrade protection to provide an
+      empty session rather than raise an exception.
     </p>
 
   </example>

ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.qhelp

@@ -43,10 +43,10 @@
       <code>protect_from_forgery with: :exception</code> can help to avoid this
       by raising an exception on an invalid CSRF token instead.
 
-      Note that Rails version 5 and later
+      Note that Rails versions 5 and later
       automatically run <code>protect_from_forgery with: :exception</code>
       by default, but manually calling <code>protect_from_forgery</code> with
-      no <code>with</code> argument will downgrade protection to null the
+      no <code>with</code> argument will downgrade protection to provide an empty
       session rather than raise an exception.
     </p>
   </recommendation>