Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

False positive GURL original... v. GURL origin #450

Open
1 of 2 tasks
fmarier opened this issue Dec 18, 2023 · 2 comments
Open
1 of 2 tasks

False positive GURL original... v. GURL origin #450

fmarier opened this issue Dec 18, 2023 · 2 comments
Assignees
@thypon
Labels
bug Something isn't working

Comments

@fmarier
Copy link
Member

fmarier commented Dec 18, 2023 •
edited by thypon
Loading

Reference: brave/brave-core#21255 (comment)

False positive on this line:

security-action/assets/semgrep_rules/client/chromium-insecure-gurl.yaml

Line 14 in 10b0d57

regex: origin

GURL original_url; matches origin whereas for this rule we really meant to match GURL origin;

Proposed Solution

  • Remove the rule
  • Fork and improve the rule
@fmarier fmarier added the bug Something isn't working label Dec 18, 2023
@fmarier fmarier mentioned this issue Dec 18, 2023
Merged
18 tasks
@thypon
Copy link
Member

thypon commented Jan 31, 2024 •
edited
Loading

@fmarier is this still worth implementing?

@fmarier
Copy link
Member Author

fmarier commented Jan 31, 2024

I think so, GURL original_url is definitely okay and doesn't need to be flagged by the GURL origin rule.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@thypon thypon

Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@fmarier @thypon @bcaller