search

spring-io / nohttp

A project for ensuring that https is used
https://spring.io/blog/2019/06/10/announcing-nohttp
Apache License 2.0
225 stars 41 forks source link

False-positive when an https link includes "http:" #24

Closed boris-petrov closed 5 years ago

boris-petrov commented 5 years ago

For example:

https://web.archive.org/web/20091028173024/http://geocities.com/McPoodle43/DVDMaestro/stl_format.html

This should not give a warning but it does.

JLLeitschuh commented 5 years ago

Shouldn't this be handled on a case-by-case-basis. This looks like an it could also indicate an open-redirect that should should probably use HTTPS in most cases?

Just my 10cents.

rwinch commented 5 years ago

@JLLeitschuh That is my two cents too. If a project wants to ignore scenarios like this, they can add a whitelist entry to cover it. I'm going to close this as won't fix.