BLC 2.0 False Positives on common services with manadory query parameters

Hello,

In testing the new cloud scanning engine introduced with BLC 2.0, I’ve run into an issue where links that contain a query parameter that cannot be omitted (such as YouTube playlists, Google calendar links, etc.)

I know that removing query parameters is the default behavior, but without some way to allowlist certain parameters or detect when parameters are a meaningful part of a URL (such as trying the URL again with the query parameters included if the stripped URL fails) this leads to a large number of false positives.

One good example is YouTube Playlists. Here’s one for the BLC team to listen to while debugging this issue ?? Below is an example of testing this URL using the curl command provided elsewhere in the support forum, both with and without the query parameter:

~: curl --header "X-Forawarded-For: 165.227.127.103" -I -A "WPMU DEV Broken Link Checker Spider" "https://www.youtube.com/playlist"
HTTP/2 404
content-type: text/html; charset=utf-8
...
~: curl --header "X-Forawarded-For: 165.227.127.103" -I -A "WPMU DEV Broken Link Checker Spider" "https://www.youtube.com/playlist?list=PLd4WuOjySbJyxmFpBOE71slcbqvK9K2jd"
HTTP/2 200
content-type: text/html; charset=utf-8
...

As you can see from the example, the only difference is the presence or absence of the “list” query parameter. Omitting that will always produce a 404 error. Please provide an update or documentation to address this issue, both for known services, and for others that may be newly created and wouldn’t be on an internal allowlist.

Thank you,
David

The page I need help with: [log in to see the link]