Sync from PR#2327

Create open_redirect_smartadserver.yml by @zoomequipd #2327 Source SHA 8fd0cc3 Triggered by @zoomequipd
sublime-security · Jan 24, 2025 · b140ebc · b140ebc
1 parent cedc95d
commit b140ebc
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/detection-rules/open_redirect_smartadserver.yml b/detection-rules/open_redirect_smartadserver.yml
@@ -9,7 +9,7 @@ source: |
       .href_url.domain.root_domain == "smartadserver.com"
       and strings.icontains(.href_url.query_params, 'go=')
       and not strings.icontains(.href_url.query_params,
-                                'go=https?(?:%3a|:)(?:%2f|\/){2}(?:[^\/]+)?smartadserver.com\/'
+                                'go=(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*smartadserver\.com(?:\&|\/|$)'
       )
   )
   // remove uses that originate from smartadserver.com
@@ -32,4 +32,4 @@ detection_methods:
   - "URL analysis"
 id: "27e5a585-891d-549d-af34-e2b8dff6d64e"
 testing_pr: 2327
-testing_sha: 96521975583335deba00080137e1a05e44262e9f
+testing_sha: 8fd0cc3d9c2682a39e28543869e18a6aa795210b