cisagov / cisagov/pshtt

Logic issue with is_redirect method

Open
#66 2 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Python
Stars
693
Forks
91
PR merge metrics
No merged PRs in 30d

Description

The way is_redirect is currently written, a domain will get flagged as a redirect if all endpoints are down or otherwise code 400-ing. For example, imagine domain.tld, which only has its https endpoint up and happens to be returning for a 404 for its index. That will return `true` for is_redirect, which is confusing (and happening a bunch where I am).

I'm curious if that whole logic block can be simplified to check and see if any of the end points are returning a code 300. That entire block starting on line 527 might reasonably be reduced to something like:

```
redirection_codes = range(300, 309)

return (https.status in redirection_codes) or (http.status in redirection_codes) or (httpswww.status in redirection_codes) or (httpwww.status in redirection_codes)
```

I'll submit a pull request and we can hash it out there.

Contributor guide

Open the contributing guide

Research direction

Start by locating the is_redirect method and the logic block around line 527, then reproduce the described case where an endpoint returns 404 or is down. Confirm that the completed behavior distinguishes actual 3xx responses from unavailable or 4xx endpoints; inspect the repository's existing tests for the appropriate regression coverage.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.