18F / domain-scan

A lightweight pipeline, locally or in Lambda, for scanning things like HTTPS, third party service use, and web accessibility.
Other
370 stars 137 forks source link

Properly ignore both blob: and data: URIs #263

Closed konklone closed 6 years ago

konklone commented 6 years ago

This filters out blob: URIs from being reported in the third_parties scanner. Like data: URIs, blob: URIs don't actually generate external connections, but do get processed as a network request through Chrome DevTools.

I also moved the checking for both URI types to be before URL.parse(), since URL.parse() (reasonably) doesn't properly parse non-URLs.