
ARoy485811 (Community Member) asked a question.
I am calling my custom cleanser methos before redirection
redirectionMethod{
customMethod(redirectURL);
final String encodedURL = ESAPI.encoder().encodeForURL(redirectURL);
response.sendRedirect(ESAPI.encoder().decodeFromURL(encodedURL));
}
@RedirectURLCleanser(userComment = "This mehod validates that redirectURL is an https one and is hosted by abc.com")
private void customMethod(String redirectURL) {
Pattern redirectURLValidator = Pattern.compile(WebConstants.REGEX);
if(!redirectURLValidator.matcher(redirectURL).matches()) {
throw new IntrusionException(REDIRECT_ERROR_LOG_MSG, REDIRECT_PATTERN_MATCH_ERROR_LOG_MSG);
}
}
.png)
HI @ARoy485811 (Community Member) ,
Could you try removing the encoding and decoding?
Veracode Static Analysis may detect it as an attempt to bypass it's analysis.
If Veracode Static Analysis is still unable to recognize your Custom Cleanser please ensure it is enabled for your organization: https://help.veracode.com/reader/RXjxbTR2MDQdN3gX4l53CQ/qBpw6yXOpKGELy9APnDXIA .
If you can confirm it is enabled for your organization, you are not encoding and decoding and it is still not recognized please contact Veracode Support by clicking your avatar in the top right corner of the Veracode Community.
Thank you,
Boy Baukema