CodeQL for Ruby: false alert for `URI.parse`
Ouverte
bug
false-positive
Ruby
- Langage dominant
- CodeQL
- Étoiles
- 10.1k
- Forks
- 2.1k
- Merge moyen
- 2 j 15 h
- PR mergées (30 j)
- 141
Description
https://github.com/ruby/ruby/security/code-scanning/127
`URI.parse('https://www.example.com/search?q=%XX')` is alerted to escape dots as the string is used as a regex and, but it is matched against `RFC3986_URI` and `RFC3986_relative_ref` which are regex both.
Guide de contribution
Ouvrir le guide de contribution
Évaluation
Cette issue n'a pas encore été évaluée.