Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dependabot Alert: Follow Redirects improperly handles URLs in the url.parse() function #163

Open
JennaySDavis opened this issue Jan 12, 2024 · 2 comments

Comments

@JennaySDavis
Copy link

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.

@JennaySDavis
Copy link
Author

#163 Acceptance Criteria

Pass/Fail Description
Pass Execute Search; sam.gov returns results to 889 Tool

Comments/Additional Notes
*A minor issue with aria labels was located, affecting the accessibility score. See https://github.com/orgs/GSA/projects/116/views/3?pane=issue&itemId=51527311

ADA Compliance (Automated scan via Chrome Lighthouse)

Criteria Score
Performance 95
Accessibility 96
Best Practices 93

Passed 01/29/2024 - JSD

@LoraBradford
Copy link

Reviewed 889 tool, did not see any issues. Story #185 will fix the accessibility score. Thank you! Moving to done!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

4 participants