RHarper142384 (Community Member) asked a question.
Acceptable ways to redirect
I have a feature for a site where when the user clicks on an external link on a page, the request is sent to a speed bump page where the domain for the request URL is checked against a configured whitelist. If the domain of the request is whitelisted, then the page should redirect to that page. I haven't found a way to get the code to pass even when the URL is scrubbed for special characters and the domain for the URL passes the whitelist check.
Must I use a know API to validate the URL or is there a pattern that is expected by the sans to get it to pass?
.png){kind=logo}
Hello RHarper142384 !
We have no recognized cleansers for URL Redirection.
To have this flaw removed from Veracode, you would need to implement the functionality using only hardcoded URLs. If that’s not feasible for your use case, then you will need to implement additional controls and submit a mitigation. The speed bump list of accepted domains sounds a reasonable approach to this.
Within Triage Flaws, selecting the grey triangle next to the Flaw ID will open the option to add an Action. Choose “Mitigating by Design” and detail the approach you have taken. I would also include detail about how the configuration of the speed bump is secured and managed, is it included in source control with a peer review mechanism for example. This can then be reviewed and approved by your security team.
Hope that helps, Seb