Unclear The finding doesn't say what the removed 'reserved name' case covered or whether its behavior is now fully absorbed by the remaining checks.
What
The internal check for whether a URL points to a trusted internal link is now a single combined check: it verifies the protocol is https:, runs a link-eligibility check, and confirms the path matches an allowed list of prefixes. A previous special case that separately handled certain 'reserved name' paths through its own dedicated function has been removed.
Why
This simplifies the trust logic for internal links into one consistent rule, removing a separate carve-out that existed before.
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
The finding doesn't say what the removed 'reserved name' case covered or whether its behavior is now fully absorbed by the remaining checks.