Repository navigation

FIX: Detect url/target params, double-encoded slashes, and backslash bypasses in OpenRedirectOutputScorer (#3324) - #3679

Merged

Roman Lutz (romanlutz) merged 5 commits into

microsoft:mainfrom

Hrushikesh-ramilla:fix/open-redirect-payload-detection-3324

Nov 2, 2026

Merged

FIX: Detect url/target params, double-encoded slashes, and backslash bypasses in OpenRedirectOutputScorer (#3324)#3679
Roman Lutz (romanlutz) merged 5 commits into
microsoft:mainfrom
Hrushikesh-ramilla:fix/open-redirect-payload-detection-3324

Commits on Oct 30, 2026
- FIX: Detect url/target params, double-encoded slashes, and backslash bypasses in OpenRedirectOutputScorer (#3324)
  Hrushikesh Ramilla (Hrushikesh-ramilla)
  committed
  5d88c3d
Commits on Nov 1, 2026
- FIX: Limit encoded redirect bypasses to value prefix and support mixed separators (#3324)
  Hrushikesh Ramilla (Hrushikesh-ramilla)
  committed
  3c67357
Commits on Nov 2, 2026
- Merge upstream main into open redirect detection branch
  
  Roman Lutz (romanlutz)
  and
  Copilot
  committed
  2610eb3
- Merge latest upstream main before encoded redirect fix
  
  Roman Lutz (romanlutz)
  and
  Copilot
  committed
  f78506a
- FIX: Preserve encoded HTTP(S) redirect authority detection
  
  Roman Lutz (romanlutz)
  and
  Copilot
  committed
  84a82d2