mirror of
https://github.com/github/codeql.git
synced 2026-01-29 14:23:03 +01:00
Apply suggestions from code review
Co-Authored-By: Max Schaefer <max@semmle.com>
This commit is contained in:
@@ -14,14 +14,14 @@ also check the second character of redirect URLs.
|
||||
|
||||
<recommendation>
|
||||
<p>
|
||||
Also disallow the patterns <code>//*</code> and <code>/\*</code> when checking redirect URLs.
|
||||
Also disallow redirect URLs starting with <code>//</code> or <code>/\</code>.
|
||||
</p>
|
||||
</recommendation>
|
||||
|
||||
<example>
|
||||
<p>
|
||||
The following function validates a (presumably untrusted) redirect URL <code>redir</code>. If it
|
||||
does not begin with <code>/</code>, the harmless placeholder redirect URL, <code>/</code> is
|
||||
does not begin with <code>/</code>, the harmless placeholder redirect URL <code>/</code> is
|
||||
returned to prevent an open redirect; otherwise <code>redir</code> itself is returned.
|
||||
</p>
|
||||
<sample src="BadRedirectCheck.go"/>
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
/**
|
||||
* @name Bad redirect check
|
||||
* @description A redirect check that checks for a leading slash but not two
|
||||
* leading slashes or a leading slash then backslash is
|
||||
* leading slashes or a leading slash followed by a backslash is
|
||||
* incomplete.
|
||||
* @kind problem
|
||||
* @problem.severity warning
|
||||
|
||||
Reference in New Issue
Block a user