Apply suggestions from code review

Co-Authored-By: Max Schaefer <max@semmle.com>
This commit is contained in:
Sauyon Lee
2020-01-16 16:11:15 -08:00
parent 3a73658a9c
commit abc9438cd3
2 changed files with 3 additions and 3 deletions

View File

@@ -14,14 +14,14 @@ also check the second character of redirect URLs.
<recommendation>
<p>
Also disallow the patterns <code>//*</code> and <code>/\*</code> when checking redirect URLs.
Also disallow redirect URLs starting with <code>//</code> or <code>/\</code>.
</p>
</recommendation>
<example>
<p>
The following function validates a (presumably untrusted) redirect URL <code>redir</code>. If it
does not begin with <code>/</code>, the harmless placeholder redirect URL, <code>/</code> is
does not begin with <code>/</code>, the harmless placeholder redirect URL <code>/</code> is
returned to prevent an open redirect; otherwise <code>redir</code> itself is returned.
</p>
<sample src="BadRedirectCheck.go"/>

View File

@@ -1,7 +1,7 @@
/**
* @name Bad redirect check
* @description A redirect check that checks for a leading slash but not two
* leading slashes or a leading slash then backslash is
* leading slashes or a leading slash followed by a backslash is
* incomplete.
* @kind problem
* @problem.severity warning