Skip to content

C#: Fix a URL redirection from remote source false positive#14953

Merged
michaelnebel merged 6 commits into
github:mainfrom
rpmrmartin:issue/14952
Dec 5, 2023
Merged

C#: Fix a URL redirection from remote source false positive#14953
michaelnebel merged 6 commits into
github:mainfrom
rpmrmartin:issue/14952

Conversation

@rpmrmartin
Copy link
Copy Markdown
Contributor

Fixes #14952

When guarding the redirect with `HttpRequestBase.IsUrlLocalToHost()`
@rpmrmartin rpmrmartin requested a review from a team as a code owner November 29, 2023 21:04
@michaelnebel michaelnebel self-requested a review December 4, 2023 08:55
Copy link
Copy Markdown
Contributor

@michaelnebel michaelnebel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for the contribution!
I will run DCA to check (after CI), if our testsuite detects an impact on performance or alerts.

@michaelnebel
Copy link
Copy Markdown
Contributor

DCA Looks good.
We probably need a second review.

@michaelnebel michaelnebel requested a review from a team December 4, 2023 15:32
Copy link
Copy Markdown
Contributor

@hvitved hvitved left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the fix; one minor comment.

Comment thread csharp/ql/test/query-tests/Security Features/CWE-601/UrlRedirect/UrlRedirect.cs Outdated
@michaelnebel michaelnebel requested a review from hvitved December 5, 2023 09:11
@michaelnebel michaelnebel merged commit e6a5c50 into github:main Dec 5, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

False positive: C# URL redirection from remote source

3 participants