Skip to content

v3.6.0

Choose a tag to compare

View all tags
@goklab goklab released this 07 Jun 17:39
· 17 commits to main since this release
v3.6.0
858b824
  • VG120 (SSRF) no longer false-positives on URLs that are provably not request-controlled: a literal https:// constant, a process.env value (including env default parameters), or a minified bundle. new URL(...) is still treated as potentially user-controlled
  • Validated old-vs-new on the corpus: 1 false positive removed, 0 true positives lost, no drift in any other rule; recall preserved by tests
  • Constant-base template URLs are left for a future dataflow engine rather than narrowed unsafely; no rule or tool changes (438 / 37); gate green (PASS/A/0)
Assets 2
Loading