{"issue":{"user":{"id":1240282,"login":"jsamuel","url":"https://api.github.com/users/jsamuel","avatar_url":"https://secure.gravatar.com/avatar/bc1d195cedb959a3946572b08ce9e7c7?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","gravatar_id":"bc1d195cedb959a3946572b08ce9e7c7"},"milestone":null,"title":"whitelist bypass through redirect to protocol-relative URL","created_at":"2011-12-22T04:11:03Z","labels":[{"name":"extension","url":"https://api.github.com/repos/RequestPolicy/requestpolicy/labels/extension","color":"ededed"}],"updated_at":"2011-12-22T04:11:15Z","state":"closed","id":2633121,"closed_at":"2011-12-22T04:11:15Z","pull_request":{"patch_url":null,"html_url":null,"diff_url":null},"html_url":"https://github.com/RequestPolicy/requestpolicy/issues/193","body":"Mike Cardwell discovered that !RequestPolicy does not correctly handle protocol-relative URLs in redirects. RP treats them as absolute paths relative to the origin's prepath.\r\n\r\nMike reported this yesterday and offered to wait until it's patched before discussing it publicly, which is much appreciated. I have a patch ready now so am making this public.","number":193,"url":"https://api.github.com/repos/RequestPolicy/requestpolicy/issues/193","comments":2,"assignee":null},"action":"closed"}