[SizzleUnrlsd]

Release 0.15.0 adds two changes, #168 and #170. Both rest on one proof about URLs, which each rule reads with its own criteria.

• Open-redirect destinations (Precision: open-redirect judges the destination a browser resolves from the target's constant text #168). open-redirect now judges each flow on the destination a browser resolves from the target's constant text.

  • A reference on the current site ("/profile/" + id, ?, #, or profile/) is refuted.
  • A fixed absolute host is a hotspot, since that host may redirect again.
  • Everything else stays a vulnerability. That includes "/" + next, because //evil.com is another host.

  The proof is shared through coretrace_python.taint.urls. ssrf now reads it too, with unchanged verdicts.

• Advisory host conditions (Advisories: a host condition decided from the URL's constant text #170). An advisory entry point may declare a host condition: the attacker must choose the host of a URL. The engine decides it from the same proof.

  • A fixed host with redirects disabled leaves the call reachable, not exploitable.
  • A fixed host with redirects followed stays exploitable, and the pending condition says a redirect may lead to a host the attacker controls.
  • Anything else stays pending.

  The environment conditions stay visible. The loader rejects a host condition that does not name its argument.

The regression corpus is unchanged. The curated requests advisories of the Enterprise plugins will declare host conditions once this release is published.

Changes in this PR

• Version: bumped in pyproject.toml, coretrace_python.__version__, the release test, and the three version examples of the usage guide: the JSON report, its tool.components, and the VEX tooling.
• CHANGELOG.md: the Unreleased section is dated as 0.15.0. No entry changed.

Verification

• pytest: 1285 passed (build installed, so the wheel tests run too).
• pytest -m regression under Python 3.12: 19 passed.
• ruff check on the tracked files and mypy: clean.

Tag v0.15.0 after merge to publish.