mikesamuel

  private static final boolean DEBUG_RDS = false;
  static void removeDotSegmentsInPlace(StringBuilder path, int left) {
    // The code below has excerpts from the spec interspersed.
    // The "input buffer" and "output buffer" referred to in the spec
    // are both just regions of path.
    // The loop deals with the exclusive cases by continuing instead
    // of proceeding to the bottom.
    boolean isAbsolute = left < path.length() && path.charAt(left) == '/';

    // RFC 3986 Section 5.2.4

mikesamuel

URL Classifier Builder

This is now implemented: https://github.com/OWASP/url-classifier

Problem

Matching URLs with regular expressions is hard. Even experienced programmers who are familiar with the URL spec produce code like /http:\/\/example.com/ which spuriously matches unintended URLs like

mikesamuel

Hello, World!

mikesamuel

Secure Header Set

_{^{tinyurl.com/sec-header-sets}}

A proposed library that provides safe defaults (with opt-out) for security-relevant HTTP response headers.

• Secure Header Set
• Background

mikesamuel

Auto-noncing in Go html/template

Background

CSP mitigates many client-side security vulnerabilities. A policy is a whitelist of locations from which JavaScript, Styles, and other content can be loaded. CSP allows nonces & hashes to make it easy for a policy to allow some inline content without allowing all inline content.