Fix url checker #3688

Diolor · 2026-02-04T16:22:06Z

Description

Fix url checker workflow.
The goal of this PR is not to fix all broken urls (some were quickly fixed though) but the tool itself.

Under the hook it uses latest https://github.com/tcort/markdown-link-check. We had many false negatives as under the hood is has some deprecated npm http-related clients. That version has an critical issue for which I have a PR. I do not intent to maintain that workflow in the long term but for now this gives us control and unblocks us from if and when that PR would get merged.
Proof that my workflow works is this Job
Relative resolution of Images works ✅

The expected output in master branch would be failure with more or less the following result (check this job). Those broken links should be fixed in another PR and are out of scope.

=========================> MARKDOWN LINK CHECK <=========================

  ERROR: 1 dead link found in ./techniques/android/MASTG-TECH-0003.md !
  [✖] https://apkmirror.com/ → Status: 403

  ERROR: 1 dead link found in ./techniques/android/MASTG-TECH-0130.md !
  [✖] https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES → Status: 404

  ERROR: 1 dead link found in ./techniques/generic/MASTG-TECH-0119.md !
  [✖] https://hackmag.com/security/ssl-sniffing/ → Status: 403

  ERROR: 1 dead link found in ./techniques/ios/MASTG-TECH-0132.md !
  [✖] https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES → Status: 404

  ERROR: 1 dead link found in ./techniques/ios/MASTG-TECH-0118.md !
  [✖] ../../Document/0x06i-Testing-Code-Quality-and-Build-Settings.md/#binary-protection-mechanisms → Status: 400

  ERROR: 1 dead link found in ./techniques/ios/MASTG-TECH-0054.md !
  [✖] https://www.npmjs.com/package/itms-services → Status: 403

  ERROR: 2 dead links found in ./Document/0x04b-Mobile-App-Security-Testing.md !
  [✖] https://www.terraform.io/ → Status: 429
  [✖] https://www.packer.io/ → Status: 429

  ERROR: 1 dead link found in ./Document/0x09-Suggested-Reading.md !
  [✖] http://gsec.hitb.org/materials/sg2016/D1%20-%20Bernhard%20Mueller%20-%20Attacking%20Software%20Tokens.pdf → Status: 404

  ERROR: 1 dead link found in ./Document/0x04g-Testing-Cryptography.md !
  [✖] https://www.bis.doc.gov/index.php/policy-guidance/encryption → Status: 0

  ERROR: 2 dead links found in ./Document/SUMMARY.md !
  [✖] 0x08a-Testing-Tools.md → Status: 400
  [✖] 0x08b-Reference-Apps.md → Status: 400

  ERROR: 2 dead links found in ./Document/0x02c-Acknowledgements.md !
  [✖] ../news/posts/2025-04-09-celebrating-3-years-advocate-nowsecure.md → Status: 400
  [✖] ../news/posts/2025-05-23-new-advocate-guardsquare.md → Status: 400

  ERROR: 1 dead link found in ./Document/0x04a-Mobile-App-Taxonomy.md !
  [✖] https://framework7.io/ → Status: 403

  ERROR: 1 dead link found in ./Document/0x04e-Testing-Authentication-and-Session-Management.md !
  [✖] https://pdfs.semanticscholar.org/13aa/7bf53070ac8e209a84f6389bab58a1e2c888.pdf → Status: 202

  ERROR: 1 dead link found in ./Document/0x05a-Platform-Overview.md !
  [✖] https://1library.net/document/z33dd47z-android-android-interprocess-communication-thorsten-schreiber-somorovsky-bussmeyer.html → Status: 403

  ERROR: 8 dead links found in ./Document/index.md !
  [✖] knowledge/ → Status: 400
  [✖] tests/ → Status: 400
  [✖] techniques/ → Status: 400
  [✖] demos/ → Status: 400
  [✖] tools/ → Status: 400
  [✖] apps/ → Status: 400
  [✖] best-practices/ → Status: 400
  [✖] ../assets/mastg_cover.png → Status: 400

  ERROR: 1 dead link found in ./.github/instructions/mastg-rules.instructions.md !
  [✖] https://academy.semgrep.dev/courses/secure-guardrails → Status: 403

  ERROR: 1 dead link found in ./.github/instructions/mastg-demo.instructions.md !
  [✖] #code-samples → Status: 404

  ERROR: 2 dead links found in ./.github/instructions/mastg-test.instructions.md !
  [✖] https://mas.owasp.org/MASTG/tests/android/MASVS-STORAGE/MASTG-TEST-0263/ → Status: 404
  [✖] Document/0x03b-Testing-Profiles.md → Status: 400

  ERROR: 1 dead link found in ./best-practices/MASTG-BEST-0021.md !
  [✖] https://devguide.owasp.org/en/12-appendices/01-implementation-dos-donts/06-exception-error-handling/ → Status: 404

  ERROR: 1 dead link found in ./best-practices/MASTG-BEST-0003.md !
  [✖] https://www.hhs.gov/hipaa/index.html → Status: 403

  ERROR: 1 dead link found in ./tools/network/MASTG-TOOL-0076.md !
  [✖] https://linuxhint.com/install-bettercap-on-ubuntu-18-04-and-use-the-events-stream/ → Status: 403

  ERROR: 2 dead links found in ./tools/android/MASTG-TOOL-0015.md !
  [✖] https://labs.withsecure.com/tools/drozer#3 → Status: 404
  [✖] https://labs.withsecure.com/tools/drozer → Status: 404

  ERROR: 2 dead links found in ./tools/android/MASTG-TOOL-0027.md !
  [✖] https://f-droid.org/de/packages/de.robv.android.xposed.installer/ → Status: 404
  [✖] https://www.xda-developers.com/xposed-framework-hub/ → Status: 404

  ERROR: 1 dead link found in ./tools/generic/MASTG-TOOL-0104.md !
  [✖] https://lucasbaizer2.github.io/hasmer/hasm/instruction-docs/hbc86.html → Status: 404

  ERROR: 1 dead link found in ./tools/ios/MASTG-TOOL-0058.md !
  [✖] https://sourceforge.net/projects/machoview/ → Status: 403

  ERROR: 1 dead link found in ./tools/ios/MASTG-TOOL-0051.md !
  [✖] https://cydia.radare.org/pool/main/g/gdb/ → Status: 0

  ERROR: 1 dead link found in ./knowledge/android/MASVS-STORAGE/MASTG-KNOW-0051.md !
  [✖] https://bugs.openjdk.org/browse/JDK-6263419 → Status: 0

  ERROR: 1 dead link found in ./knowledge/android/MASVS-STORAGE/MASTG-KNOW-0047.md !
  [✖] 0x04g-Testing-Cryptography.md#improper-key-derivation-functions → Status: 400

  ERROR: 3 dead links found in ./knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0021.md !
  [✖] 0x05d-Testing-Data-Storage.md → Status: 400
  [✖] https://satyan.github.io/sugar/ → Status: 404
  [✖] https://www.cvedetails.com/cve/CVE-2015-5237/ → Status: 403

  ERROR: 1 dead link found in ./knowledge/android/MASVS-CODE/MASTG-KNOW-0005.md !
  [✖] 0x04h-Testing-Code-Quality.md#memory-corruption-bugs → Status: 400

  ERROR: 6 dead links found in ./knowledge/android/MASVS-CODE/MASTG-KNOW-0006.md !
  [✖] 0x04h-Testing-Code-Quality.md#binary-protection-mechanisms → Status: 400
  [✖] 0x04h-Testing-Code-Quality.md#position-independent-code → Status: 400
  [✖] 0x04h-Testing-Code-Quality.md#memory-management → Status: 400
  [✖] 0x04h-Testing-Code-Quality.md#manual-memory-management → Status: 400
  [✖] 0x04h-Testing-Code-Quality.md#memory-corruption-bugs → Status: 400
  [✖] 0x04h-Testing-Code-Quality.md#stack-smashing-protection → Status: 400

  ERROR: 1 dead link found in ./knowledge/android/MASVS-NETWORK/MASTG-KNOW-0015.md !
  [✖] 0x04f-Testing-Network-Communication.md/#restricting-trust-identity-pinning → Status: 400

  ERROR: 1 dead link found in ./knowledge/android/MASVS-RESILIENCE/MASTG-KNOW-0028.md !
  [✖] https://github.com/gperftools/gperftools/blob/master/src/heap-checker.cc#L112 → Status: 404

  ERROR: 2 dead links found in ./knowledge/android/MASVS-RESILIENCE/MASTG-KNOW-0033.md !
  [✖] 0x04c-Tampering-and-Reverse-Engineering.md#obfuscation → Status: 400
  [✖] https://www.theses.fr/2020REN1S047.pdf → Status: 0

  ERROR: 1 dead link found in ./knowledge/android/MASVS-RESILIENCE/MASTG-KNOW-0027.md !
  [✖] https://resources.infosecinstitute.com/android-hacking-security-part-8-root-detection-evasion// → Status: 0

  ERROR: 1 dead link found in ./knowledge/android/MASVS-CRYPTO/MASTG-KNOW-0012.md !
  [✖] 0x04g-Testing-Cryptography.md#improper-key-derivation-functions → Status: 400

  ERROR: 1 dead link found in ./knowledge/ios/MASVS-STORAGE/MASTG-KNOW-0093.md !
  [✖] https://developer.apple.com/documentation/foundation/preferences → Status: 404

  ERROR: 1 dead link found in ./knowledge/ios/MASVS-PLATFORM/MASTG-KNOW-0077.md !
  [✖] 0x06d-Testing-Data-Storage.md → Status: 400

  ERROR: 2 dead links found in ./knowledge/ios/MASVS-PLATFORM/MASTG-KNOW-0075.md !
  [✖] 0x06d-Testing-Data-Storage.md → Status: 400
  [✖] https://www.cvedetails.com/cve/CVE-2015-5237/ → Status: 403

  ERROR: 1 dead link found in ./knowledge/ios/MASVS-PLATFORM/MASTG-KNOW-0074.md !
  [✖] https://www.npmjs.com/package/react-native-appstore-version-checker → Status: 403

  ERROR: 1 dead link found in ./knowledge/ios/MASVS-CODE/MASTG-KNOW-0060.md !
  [✖] 0x04h-Testing-Code-Quality.md#memory-corruption-bugs → Status: 400

  ERROR: 6 dead links found in ./knowledge/ios/MASVS-CODE/MASTG-KNOW-0061.md !
  [✖] 0x04h-Testing-Code-Quality.md#binary-protection-mechanisms → Status: 400
  [✖] 0x04h-Testing-Code-Quality.md#position-independent-code → Status: 400
  [✖] 0x04h-Testing-Code-Quality.md#memory-management → Status: 400
  [✖] 0x04h-Testing-Code-Quality.md#manual-memory-management → Status: 400
  [✖] 0x04h-Testing-Code-Quality.md#memory-corruption-bugs → Status: 400
  [✖] 0x04h-Testing-Code-Quality.md#stack-smashing-protection → Status: 400

  ERROR: 1 dead link found in ./knowledge/ios/MASVS-CODE/MASTG-KNOW-0059.md !
  [✖] 0x04f-Testing-Network-Communication.md#intercepting-network-traffic-through-mitm → Status: 400

  ERROR: 1 dead link found in ./knowledge/ios/MASVS-CODE/MASTG-KNOW-0058.md !
  [✖] 0x06a-Platform-Overview.md#code-signing → Status: 400

  ERROR: 1 dead link found in ./knowledge/ios/MASVS-RESILIENCE/MASTG-KNOW-0089.md !
  [✖] 0x04c-Tampering-and-Reverse-Engineering.md#obfuscation → Status: 400

  ERROR: 1 dead link found in ./knowledge/ios/MASVS-RESILIENCE/MASTG-KNOW-0088.md !
  [✖] 0x06b-iOS-Security-Testing.md#testing-on-the-ios-simulator → Status: 400

  ERROR: 1 dead link found in ./knowledge/ios/MASVS-CRYPTO/MASTG-KNOW-0069.md !
  [✖] 0x06d-Testing-Data-Storage.md → Status: 400

  ERROR: 1 dead link found in ./tests/android/MASVS-CODE/MASTG-TEST-0002.md !
  [✖] https://www.cvedetails.com/cve/CVE-2018-1000613/ → Status: 403

  ERROR: 1 dead link found in ./tests/android/MASVS-RESILIENCE/MASTG-TEST-0041.md !
  [✖] https://code.tutsplus.com/tutorials/android-best-practices-strictmode--mobile-7581 → Status: 403

  ERROR: 1 dead link found in ./tests/android/MASVS-CRYPTO/MASTG-TEST-0016.md !
  [✖] https://franklinta.com/2014/08/31/predicting-the-next-math-random-in-java/ → Status: 0

  ERROR: 1 dead link found in ./tests/ios/MASVS-PLATFORM/MASTG-TEST-0075.md !
  [✖] https://ios.gadgethacks.com/news/always-updated-list-ios-app-url-scheme-names-0184033/ → Status: 403

  ERROR: 1 dead link found in ./demos/android/MASVS-NETWORK/MASTG-DEMO-0056/MASTG-DEMO-0056.md !
  [✖] https://tlsexpired.no/ → Status: 0

  ERROR: 1 dead link found in ./demos/android/MASVS-NETWORK/MASTG-DEMO-0057/MASTG-DEMO-0057.md !
  [✖] https://mitm-software.badssl.com/ → Status: 0

  ERROR: 1 dead link found in ./demos/android/MASVS-NETWORK/MASTG-DEMO-0054/MASTG-DEMO-0054.md !
  [✖] https://tlsexpired.no/ → Status: 0

  ERROR: 1 dead link found in ./tests-beta/android/MASVS-STORAGE/MASTG-TEST-0231.md !
  [✖] ../../../0x05d-Testing-Data-Storage.md/#logs → Status: 400

  ERROR: 1 dead link found in ./tests-beta/android/MASVS-STORAGE/MASTG-TEST-0207.md !
  [✖] ../../../Document/0x05d-Testing-Data-Storage.md/#internal-storage → Status: 400

  ERROR: 1 dead link found in ./tests-beta/android/MASVS-STORAGE/MASTG-TEST-0262.md !
  [✖] ../../../Document/0x05d-Testing-Data-Storage.md/#backups → Status: 400

  ERROR: 1 dead link found in ./tests-beta/android/MASVS-STORAGE/MASTG-TEST-0201.md !
  [✖] ../../../0x05d-Testing-Data-Storage.md/#external-storage-apis → Status: 400

  ERROR: 1 dead link found in ./tests-beta/android/MASVS-STORAGE/MASTG-TEST-0203.md !
  [✖] ../../../0x05d-Testing-Data-Storage.md/#logs → Status: 400

  ERROR: 3 dead links found in ./tests-beta/android/MASVS-STORAGE/MASTG-TEST-0202.md !
  [✖] ../../../0x05d-Testing-Data-Storage.md/#external-storage-apis → Status: 400
  [✖] ../../../0x05d-Testing-Data-Storage.md/#mediastore-api → Status: 400
  [✖] ../../../0x05d-Testing-Data-Storage.md/#manifest-permissions → Status: 400

  ERROR: 1 dead link found in ./tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0250.md !
  [✖] ../../../Document/0x05h-Testing-Platform-Interaction.md/#webview-content-provider-access → Status: 400

  ERROR: 1 dead link found in ./tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0252.md !
  [✖] ../../../Document/0x05h-Testing-Platform-Interaction.md/#webview-local-file-access-settings → Status: 400

  ERROR: 2 dead links found in ./tests-beta/android/MASVS-CODE/MASTG-TEST-0223.md !
  [✖] ../../../Document/0x05i-Testing-Code-Quality-and-Build-Settings.md/#binary-protection-mechanisms → Status: 400
  [✖] ../../../Document/0x04h-Testing-Code-Quality.md/#stack-smashing-protection → Status: 400

  ERROR: 2 dead links found in ./tests-beta/android/MASVS-CODE/MASTG-TEST-0222.md !
  [✖] ../../../Document/0x05i-Testing-Code-Quality-and-Build-Settings.md/#binary-protection-mechanisms → Status: 400
  [✖] ../../../Document/0x04h-Testing-Code-Quality.md/#position-independent-code → Status: 400

  ERROR: 1 dead link found in ./tests-beta/android/MASVS-NETWORK/MASTG-TEST-0243.md !
  [✖] %22../../../Document/0x05g-Testing-Network-Communication.md#certificate-pinning%22 → Status: 400

  ERROR: 1 dead link found in ./tests-beta/android/MASVS-NETWORK/MASTG-TEST-0242.md !
  [✖] %22../../../Document/0x05g-Testing-Network-Communication.md#pinning-via-network-security-configuration-api-24%22 → Status: 400

  ERROR: 1 dead link found in ./tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0204.md !
  [✖] https://franklinta.com/2014/08/31/predicting-the-next-math-random-in-java/ → Status: 0

  ERROR: 1 dead link found in ./tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0276.md !
  [✖] ../../../Document/0x06h-Testing-Platform-Interaction.md/#pasteboard → Status: 400

  ERROR: 1 dead link found in ./tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0279.md !
  [✖] ../../../Document/0x06h-Testing-Platform-Interaction.md/#pasteboard → Status: 400

  ERROR: 1 dead link found in ./tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0278.md !
  [✖] ../../../Document/0x06h-Testing-Platform-Interaction.md/#pasteboard → Status: 400

  ERROR: 1 dead link found in ./tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0280.md !
  [✖] ../../../Document/0x06h-Testing-Platform-Interaction.md/#pasteboard → Status: 400

  ERROR: 1 dead link found in ./tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0277.md !
  [✖] ../../../Document/0x06h-Testing-Platform-Interaction.md/#pasteboard → Status: 400

  ERROR: 1 dead link found in ./tests-beta/ios/MASVS-CODE/MASTG-TEST-0229.md !
  [✖] ../../../Document/0x06i-Testing-Code-Quality-and-Build-Settings.md/#binary-protection-mechanisms → Status: 400

  ERROR: 1 dead link found in ./tests-beta/ios/MASVS-CODE/MASTG-TEST-0230.md !
  [✖] ../../../Document/0x04h-Testing-Code-Quality.md/#automatic-reference-counting → Status: 400

  ERROR: 1 dead link found in ./tests-beta/ios/MASVS-CODE/MASTG-TEST-0228.md !
  [✖] ../../../Document/0x04h-Testing-Code-Quality.md/#position-independent-code → Status: 400

=========================================================================

AI Tool Disclosure

This contribution does not include AI-generated content.

# Conflicts: # .github/workflows/url-checker-pr.yml

cpholguera · 2026-02-04T21:06:26Z

Awesome, thank you!

I'm sure there currently are false negatives. However, are you sure we don't have false positives in the new version? I'm seeing a lot of Image/... Which actually exists, it's just that we resolve that at build time (website).

Diolor · 2026-02-04T22:59:00Z

@cpholguera I noticed that too. That's why it's still draft 🙂

cpholguera · 2026-02-04T23:02:04Z

Fair enough 😁

.github/workflows/url-checker-pr.yml

# Conflicts: # tests-beta/android/MASVS-NETWORK/MASTG-TEST-0217.md # tests-beta/android/MASVS-NETWORK/MASTG-TEST-0218.md # tests-beta/android/MASVS-NETWORK/MASTG-TEST-0242.md

Fix url checker

2ba8e8d

Diolor added the automation label Feb 4, 2026

Diolor added 8 commits February 4, 2026 17:26

Update away from deprecated link-checker action

ff08ffb

Merge branch 'master' into fix-urls

0bf2d7f

Remove some urls

c8e5771

Merge remote-tracking branch 'origin/fix-urls' into fix-urls

8d7f429

Temporarily remove params

cddc0dc

Temporarily remove params

8fb9d84

Merge remote-tracking branch 'origin/fix-urls' into fix-urls

815293f

# Conflicts: # .github/workflows/url-checker-pr.yml

Intentionally break things

bb5d20c

Diolor self-assigned this Feb 4, 2026

Diolor added 10 commits February 4, 2026 18:06

Bump version

2800e1d

Revert version

683cfd1

Test fix

c8f779c

Revert deprecated linter

ca7ffe7

Verify fix

d20a873

No depth need

0e1c6b4

Capitalize!

01565c2

Fix use

23c8c06

Fix use 1.1

ddcb6b2

revert check-modified-files-only

f10da65

Diolor added 2 commits February 5, 2026 11:03

Update link check

d7ec1f7

Fix images

77a87f8

Diolor requested a review from cpholguera February 5, 2026 11:15

Diolor marked this pull request as ready for review February 5, 2026 11:16

Diolor added 2 commits February 5, 2026 12:43

Typos

ef78f0e

Sanity check

992d024

Diolor commented Feb 5, 2026

View reviewed changes

.github/workflows/url-checker-pr.yml Outdated Show resolved Hide resolved

Diolor added 4 commits February 5, 2026 13:58

Revert sanity check

27c5e72

Bonus: fix few prominent link errors

e873af6

Bonus: fix few prominent link errors

5959c99

Merge remote-tracking branch 'origin/fix-urls' into fix-urls

1c9585c

# Conflicts: # tests-beta/android/MASVS-NETWORK/MASTG-TEST-0217.md # tests-beta/android/MASVS-NETWORK/MASTG-TEST-0218.md # tests-beta/android/MASVS-NETWORK/MASTG-TEST-0242.md

cpholguera approved these changes Feb 5, 2026

View reviewed changes

cpholguera merged commit c6d25ba into OWASP:master Feb 5, 2026
5 checks passed

Diolor deleted the fix-urls branch February 5, 2026 18:06

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix url checker #3688

Fix url checker #3688

Uh oh!

Diolor commented Feb 4, 2026 •

edited

Loading

Uh oh!

cpholguera commented Feb 4, 2026

Uh oh!

Diolor commented Feb 4, 2026

Uh oh!

cpholguera commented Feb 4, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Fix url checker #3688

Fix url checker #3688

Uh oh!

Conversation

Diolor commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

AI Tool Disclosure

Uh oh!

cpholguera commented Feb 4, 2026

Uh oh!

Diolor commented Feb 4, 2026

Uh oh!

cpholguera commented Feb 4, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Diolor commented Feb 4, 2026 •

edited

Loading