[Vardhman Gupta (Kaap10)]

Description

Extends OpenRedirectOutputScorer to detect redirect parameters pointing to dangerous pseudo-protocols (javascript:, vbscript:, and executable data: MIME types), including percent-encoded colons and MIME subtype separators.

• Added _COLON, _SLASH, _PLUS, and _EXECUTABLE_DATA_MIME_TYPES helpers (reusing _COLON inside _HTTP_SCHEME) and added "Pseudo-Protocol Redirect" to OpenRedirectOutputScorer._DEFAULT_PATTERNS.
• Used \s*(?:[\"']\s*)? to avoid quadratic whitespace backtracking and [^\s"'] to prevent matching empty quoted protocols (redirect="javascript:"), while scoping data: URIs to executable MIME types (text/html, image/svg+xml, javascript, ecmascript).
• Updated the OpenRedirectOutputScorer class docstring to document pseudo-protocol redirect detection.
• Added positive, rationale, and negative boundary unit tests in test_open_redirect_output_scorer.py covering raw/encoded javascript:, vbscript:, executable/non-executable data: URIs, ;base64 payloads, and prose exclusions.

Demonstration

For "https://example.com/login?redirect=javascript:alert(1)":

• Before: score_value="false" (rationale: "")
• After: score_value="true" ("Matched: Pseudo-Protocol Redirect")

For "https://example.com/login?url=data:image/png;base64,iVBORw0KGgo=":

• Before & After: score_value="false" (rationale: "")

Closes #4235

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

[Aman (its-amann)]

data:application/xhtml+xml slips past this list, browsers run script in xhtml data URIs same as text/html, so url=data:application/xhtml+xml,<html xmlns="http://www.w3.org/1999/xhtml"><script>alert(1)</script></html> still scores false

Suggested change

	rf"|application{_SLASH}(?:x-)?javascript)(?![A-Za-z0-9+_-])"
	rf"|application{_SLASH}(?:(?:x-)?javascript|xhtml{_PLUS}xml))(?![A-Za-z0-9+_-])"

fixed this plus a test in this commit, you can just cherry pick it instead of redoing it: its-amann@caaaf07

[Vardhman Gupta (Kaap10)]

Good catch! Modern browsers do parse and execute scripts inside application/xhtml+xml data URIs. Added detection along with positive and negative lookahead test cases in 7a6d08f. Thanks for the review!