CodeQL for Ruby: false alert for `URI.parse`
Abierto
bug
false-positive
Ruby
- Lenguaje dominante
- CodeQL
- Estrellas
- 10.1k
- Forks
- 2.1k
- Merge medio
- 2 d 15 h
- PR fusionados (30 d)
- 141
Descripción
https://github.com/ruby/ruby/security/code-scanning/127
`URI.parse('https://www.example.com/search?q=%XX')` is alerted to escape dots as the string is used as a regex and, but it is matched against `RFC3986_URI` and `RFC3986_relative_ref` which are regex both.
Guía de contribución
Evaluación
Este issue todavía no se ha evaluado.