07-24-2021, 11:32 PM
I've already responded via e-mail, yesterday.
The point is that seems that the auditors don't like self-modifying code, but this is a legit case. From their report:
"The URL header may be changed by an external entity. If this change is authentic then you can neutralize it."
yes, it is authentic. There is nothing wrong going on and they would know by code inspection.
The point is that seems that the auditors don't like self-modifying code, but this is a legit case. From their report:
"The URL header may be changed by an external entity. If this change is authentic then you can neutralize it."
yes, it is authentic. There is nothing wrong going on and they would know by code inspection.