Chris Smowton 6933d06a46 Add exactly the string '/' as a sanitizing prefix. ...

Usually this is ignored for suspicion that it could be taken for a protocol specifier, but on balance the context `(something) + "/" + tainted()` is more likely to be taken for a user-controlled location within a host the user does not control.

2021-06-17 11:41:03 +01:00

..

JaxWsSSRF.java

Promote SSRF query to main query set

2021-06-17 11:41:01 +01:00

options

Promote SSRF query to main query set

2021-06-17 11:41:01 +01:00

RequestForgery2.java

Promote SSRF query to main query set

2021-06-17 11:41:01 +01:00

RequestForgery.expected

SSRF query: add sanitizer looking for a variety of ways of prepending a sanitizing prefix, such as one that restricts the hostname a URI will refer to.

2021-06-17 11:41:03 +01:00

RequestForgery.java

Add exactly the string '/' as a sanitizing prefix.

2021-06-17 11:41:03 +01:00

RequestForgery.qlref

Promote SSRF query to main query set

2021-06-17 11:41:01 +01:00

Sinks.java

Promote SSRF query to main query set

2021-06-17 11:41:01 +01:00

SpringSSRF.java

Promote SSRF query to main query set

2021-06-17 11:41:01 +01:00