<!DOCTYPE qhelp PUBLIC

"-//Semmle//qhelp//EN"

"qhelp.dtd">

<qhelp>

<overview>

<p>Directly incorporating user input into a URL redirect request without validating the input

can facilitate phishing attacks. In these attacks, unsuspecting users can be redirected to a

malicious site that looks very similar to the real site they intend to visit, but which is

controlled by the attacker.</p>

</overview>

<recommendation>

<p>To guard against untrusted URL redirection, it is advisable to avoid putting user input

directly into a redirect URL. Instead, maintain a list of authorized

redirects on the server; then choose from that list based on the user input provided.</p>

<p>

If this is not possible, then the user input should be validated in some other way,

for example, by verifying that the target URL is on the same host as the current page.

</p>

</recommendation>

<example>

<p>

The following example shows an HTTP request parameter being used directly in a URL redirect

without validating the input, which facilitates phishing attacks:

</p>

<sample src="examples/UrlRedirect.java"/>

<p>

One way to remedy the problem is to validate the user input against a known fixed string

before doing the redirection:

</p>

<sample src="examples/UrlRedirectGood.java"/>

<p>

Alternatively, we can check that the target URL does not redirect to a different host

by checking that the URL is either relative or on a known good host:

</p>

<sample src="examples/UrlRedirectGoodDomain.java"/>

<p>

Note that as written, the above code will allow redirects to URLs on <code>example.com</code>,

which is harmless but perhaps not intended. You can substitute your own domain (if known) for

<code>example.com</code> to prevent this.

</p>

</example>

<references>

<li>

OWASP:

<a href="https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html">

Unvalidated Redirects and Forwards Cheat Sheet</a>.

</li>

<li>

Microsoft Docs: <a href="https://docs.microsoft.com/en-us/aspnet/mvc/overview/security/preventing-open-redirection-attacks">Preventing Open Redirection Attacks (C#)</a>.

</li>

</references>

</qhelp>