tally/curl-should-follow-redirects

​

Description

• ADD <url> follows up to 10 redirects (Go net/http default behavior)
• wget follows up to 20 redirects by default

​

--location vs --follow

• --location (-L) — suggested for standard downloads (GET, POST, PUT, or no -X). This is the classic redirect flag available in all curl versions.
• --follow — suggested when -X/--request specifies a method other than GET, POST, or PUT (e.g., DELETE, PATCH, QUERY). --location changes non-GET methods to GET on 301/302 redirects, which breaks these methods. --follow (curl 8.16.0+) preserves the HTTP method across redirects.

​

Examples

​

Before (violation)

FROM ubuntu:22.04
RUN curl -fsSo /tmp/file.tar.gz https://example.com/file.tar.gz
RUN curl -X DELETE https://example.com/api/item/123

​

After (fixed with —fix —fix-unsafe)

FROM ubuntu:22.04
RUN curl --location -fsSo /tmp/file.tar.gz https://example.com/file.tar.gz
RUN curl --follow -X DELETE https://example.com/api/item/123

​

Exceptions

• -L or --location is already present (including combined flags like -fsSL)
• --location-trusted is present (implies redirect following)
• --follow is already present (curl 8.16.0+)
• All URL arguments point to IP addresses (e.g., http://127.0.0.1:8080/health, http://10.0.0.1/api), since local/internal services typically don’t redirect
• The curl command is a non-transfer invocation (--help, --version, --manual) where redirect flags have no effect

​

Limitations

• Only detects curl commands directly visible to the shell parser; commands inside variables or dynamically constructed strings are not analyzed
• Skips non-POSIX shells (e.g., PowerShell stages)

​

References

• curl --location documentation
• Follow redirects, but differently — curl 8.16.0 --follow flag
• Dockerfile ADD reference