Add CWE-601 open redirect test case (Python) - #174
Merged
ralyodio merged 7 commits intoAug 17, 2026
Conversation
Contributor
Author
|
Fifth submission for the uGig listing: Python CWE-601 open-redirect case (2 VULNERABLE: + 1 SAFE:). |
…asses api.example.com resolves, which trips safety rule 3 (no resolvable network destinations). Switch to api.example.invalid (RFC 2606) and correct the @safe-guard text, which claimed no hosts were referenced. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Regenerated the catalog rather than hand-resolving it, which is the only resolution that cannot silently drop an entry. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Test Case Submission
docs/CONTRIBUTING.mdif False:)example.invalid)VULNERABLE:and correct-code lines withSAFE:Details
nextparameternextparam (or a brokenstartswithhostcheck that
host.attacker.example.invalidbypasses) lets an attacker phish users under theoriginal domain's trust. Adds the Python surface with a relative-path allow-list
SAFE:control.Safety statement
All handlers are wrapped in
if False:and never invoked. No response is produced and no hostsexcept RFC 2606
.invalidappear. Nothing performs I/O even if the guard were removed.Scanner result
Leave blank on submission — CI fills this in.