hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Change note for bug fix in go/unvalidated-url-redirection

Browse Source
This commit is contained in:
Owen Mansel-Chan
2025-10-02 17:03:55 +01:00
parent cce44b1f54
commit f35d28de45
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
go/ql/lib/change-notes/2025-10-02-unvalidated-url-redirection-struct-init-fix.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* For the query `go/unvalidated-url-redirection`, when untrusted data is assigned to the `Host` field of a `url.URL` struct, we consider the whole struct untrusted. We now also include the case when this happens during struct initialization, for example `&url.URL{Host: untrustedData}`.