4 ms·
Yes, client-side URL calculation and/or a whitelist of acceptable URLs would be a significant improvement. Thankfully command-line curl won't follow redirects
by DanielDent 8y ago
Yes, client-side URL calculation and/or a whitelist of acceptable URLs would be a significant improvement.
Thankfully command-line curl won't follow redirects unless you pass it a special flag, though if you do need it to follow redirects, I'm not sure what the best way is to restrict the range of redirects that it will follow.
This issue was part of a broader coordinated disclosure and was only published today. I've gotten in touch with B2 support & I'm hoping my support ticket will make it to the correct people.