SBoova646688 (Community Member) asked a question.
I am looking for an acceptable way to redirect inside my application. In my research I have seen suggestions of using isurllocaltohost, however this does not seem to be available in VB .NET web forms. Below is the code i have tried to fix but is still flagged.
Dim url2 = New Uri(HttpContext.Current.Request.Url.AbsoluteUri)
If Session("RoleOfUser").ToString() = "SMA" Then
Dim redirectUrl As String = url2.Scheme & "://" & url2.Authority & "/Payroll/TimeTracking.aspx?dt=" & txtFrom.Text & "&PrTimeTrackingId=" & PRTimeTrackingTimeId.Value & "&plantid=" & ddlPlantJobs.SelectedValue & "&PRTimeTrackingHoursID=" & PRTimeTrackingHoursID.Value & "&UserID=" & UserID & "&PlantjobId=" & PlantSysID
Dim url = New Uri(redirectUrl)
Dim ctx = HttpContext.Current
If url.Host.Equals(ctx.Request.Url.Host) AndAlso url.Port.Equals(ctx.Request.Url.Port) Then
If Not url.ToString().Contains("returnUrl") Then
Response.Redirect(url.ToString())
End If
End If
Else
Dim redirectUrl As String = url2.Scheme & "://" & url2.Authority & "/Payroll/TimeTracking.aspx?dt=" & txtFrom.Text & "&PrTimeTrackingId=" & PRTimeTrackingTimeId.Value & "&plantid=" & ddlPlantJobs.SelectedValue & "&PRTimeTrackingHoursID=" & PRTimeTrackingHoursID.Value
Dim url = New Uri(redirectUrl)
Dim ctx = HttpContext.Current
If url.Host.Equals(ctx.Request.Url.Host) AndAlso url.Port.Equals(ctx.Request.Url.Port) Then
Response.Redirect(redirectUrl)
End If
End If
.png){kind=logo}
Veracode Static Analysis detects CWE-601: URL Redirection to Untrusted Site ('Open Redirect') when it can detect data from outside of the application (for example from an HTTP request, but also from a file, database query or webservice) going into a URL.
It does not parse the URL or detect at what place this data is placed (as this is very difficult). What we typically recommend is:
In the given example I would recommend getting from trusted configuration or a hardcoded value the host and scheme and applying URL encoding to all dynamic query parameters.
Please note that URL encoding, while recommended for query parameters, is not appropriate for the host and path part of a URL and as such is not automatically recognized by Veracode Static Analysis and will require a mitigation proposal ( https://help.veracode.com/r/improve_mitigation ) which you will need to get reviewed by your security team.
Thank you,
Boy Baukema