CodeQL for Ruby: false alert for `URI.parse`
未关闭
bug
false-positive
Ruby
- 主要语言
- CodeQL
- 星标
- 10.1k
- 派生
- 2.1k
- 平均合并
- 2 天 15 小时
- 30 天内合并 PR
- 141
描述
https://github.com/ruby/ruby/security/code-scanning/127
`URI.parse('https://www.example.com/search?q=%XX')` is alerted to escape dots as the string is used as a regex and, but it is matched against `RFC3986_URI` and `RFC3986_relative_ref` which are regex both.
贡献指南
评估
这个 Issue 还没有评估数据。