Sync from PR#2325

Create open_redirect_bubblelife.yml by @zoomequipd #2325 Source SHA 60f53a9 Triggered by @zoomequipd
sublime-security · Jan 24, 2025 · 3c6eedf · 3c6eedf
1 parent b140ebc
commit 3c6eedf
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/detection-rules/open_redirect_bubblelife.yml b/detection-rules/open_redirect_bubblelife.yml
@@ -10,7 +10,7 @@ source: |
       and strings.istarts_with(.href_url.path, '/click/')
       and strings.icontains(.href_url.query_params, 'url=')
       and not strings.icontains(.href_url.query_params,
-                                'url=https?:\/\/(?:[^\/]+)?bubblelife.com\/'
+                                'url=(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*bubblelife\.com(?:\&|\/|$)'
       )
   )
   // remove uses that originate from bubblelife.com
@@ -33,4 +33,4 @@ detection_methods:
   - "URL analysis"
 id: "53c9b893-e6bc-5dd1-afc8-fa4ced9bd341"
 testing_pr: 2325
-testing_sha: 6da08da80dbee03f46532b50161d32b4a61775af
+testing_sha: 60f53a91b96b5eeb0967a6cbcf7a8c8614612a2b