GMi211506 (Community Member) asked a question.
So I have a service in angular application, in which I do http get request :
import { Injectable } from '@angular/core';
import { HttpClient } from '@angular/common/http';
import { AppConfigService } from '../../shared/services/app-config/app-config.service';
import { Observable } from 'rxjs';
import { BaseComponent } from 'src/app/shared/models/base-component';
@Injectable({
providedIn: 'root'
})
export class ViewService {
constructor(
private _http: HttpClient,
private _appConfig: AppConfigService
) {}
getView(type: number, id: number): Observable<BaseComponent> {
return this._http.get<BaseComponent>(
`${this._appConfig.config.apiUrl}/components/${type}/${id}`
);
}
}
I don't understand why I'm getting this flaw... Anybody have an idea?
Thanks!
.png){kind=logo}
Hi @GMi211506 (Community Member) ,
Veracode Static Analysis reports CWE-601: URL Redirection to Untrusted Site ('Open Redirect') in Angular applications is it can detect that a URL is requested but that URL contains data from outside of the (JavaScript) application. The concern being that if an attacker is able to modify the dynamic data they might get your application to make arbitrary requests. It is very much like CWE-918: Server-Side Request Forgery (SSRF) except that an Angular application is not expected to run server side.
Veracode Static Analysis will only be able to automatically detect remediation and close the flaw if the data is hardcoded, in most cases this would break the functionality and you must implement URL encoding (with encodeURIComponent) and/or custom validation (for example with a Regex) that you can then document in a mitigation proposal ( https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/~p4MSKOS8F8X8h0KwFTKoQ ) and have reviewed by a member of your organizations security team.
If you would review this flaw in detail with the full application context with an Veracode Application Security Consultant please contact support by clicking your avatar in the Veracode Community and clicking "Contact Support" in the resulting menu or schedule a Consultation through the Veracode Platform. You can find more information on how to do this here: https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/7YQTCDJKFEQzL3gL_N90hQ
Thank you,
Boy Baukema