brave / brave/security-action

False positive `GURL original...` v. `GURL origin`

Open
#450 2 comments 0 reactions 1 assignee Assigned to @thypon View on GitHub
bug
Dominant language
JavaScript
Stars
22
Forks
8
Avg merge
2d 6h
Merged PRs (30d)
40

Description

Reference: https://github.com/brave/brave-core/pull/21255#discussion_r1430739970

False positive on this line:
https://github.com/brave/security-action/blob/10b0d57eaf6d8739e510c1018fc372f7329e86eb/assets/semgrep_rules/client/chromium-insecure-gurl.yaml#L14

`GURL original_url;` matches `origin` whereas for this rule we really meant to match `GURL origin;`

# Proposed Solution

- [ ] Remove the rule
- [x] Fork and improve the rule

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.