Potential fix for code scanning alert no. 1: Incomplete URL scheme check

moutonjeremy · github-advanced-security[bot] · web-flow · commit 30cf5e074151 · 2025-11-05T18:04:19.000+01:00
Co-authored-by: Copilot Autofix powered by AI &lt;62310815+github-advanced-security[bot]@users.noreply.github.com&gt;
diff --git a/interfaces/http/app/proxy.go b/interfaces/http/app/proxy.go
@@ -452,7 +452,7 @@ func (ctrl *ProxyController) rewriteURL(urlStr string, baseURL *url.URL, proxyBa
 	// Ne pas proxifier les URLs data:, blob:, about:, javascript:, etc.
 	if strings.HasPrefix(urlStr, "data:") || strings.HasPrefix(urlStr, "blob:") ||
 		strings.HasPrefix(urlStr, "about:") || strings.HasPrefix(urlStr, "javascript:") ||
-		strings.HasPrefix(urlStr, "mailto:") || strings.HasPrefix(urlStr, "tel:") {
+		strings.HasPrefix(urlStr, "vbscript:") || strings.HasPrefix(urlStr, "mailto:") || strings.HasPrefix(urlStr, "tel:") {
 		return urlStr
 	}
 

Original file line number	Diff line number	Diff line change
`@@ -452,7 +452,7 @@ func (ctrl ProxyController) rewriteURL(urlStr string, baseURL url.URL, proxyBa`
`452`	`452`	`// Ne pas proxifier les URLs data:, blob:, about:, javascript:, etc.`
`453`	`453`	`if strings.HasPrefix(urlStr, "data:") \|\| strings.HasPrefix(urlStr, "blob:") \|\|`
`454`	`454`	`strings.HasPrefix(urlStr, "about:") \|\| strings.HasPrefix(urlStr, "javascript:") \|\|`
`455`		`- strings.HasPrefix(urlStr, "mailto:") \|\| strings.HasPrefix(urlStr, "tel:") {`
	`455`	`+ strings.HasPrefix(urlStr, "vbscript:") \|\| strings.HasPrefix(urlStr, "mailto:") \|\| strings.HasPrefix(urlStr, "tel:") {`
`456`	`456`	`return urlStr`
`457`	`457`	`}`
`458`	`458`