VBollineni837118 (Community Member) asked a question.
Insufficient Input Validation - A web application accepts a untrusted input that specifies a link to an external site, and uses that link to generate a redirect. This enables phishing attacks. How can we handle this ?
I tried to resolve "URL Redirection to Untrusted Site(Open Redirect)" vulnerability issue by following below two code approaches but still unable to resolve it -
.png){kind=logo}
Hi @VBollineni837118 (Community Member),
Using .NET's built-in `Url.IsLocalUrl` functionality (https://docs.microsoft.com/en-us/dotnet/api/system.web.mvc.urlhelper.islocalurl) should make the flaw automatically disappear. However, for Veracode Static Analysis to be sure that all code paths involve this check, please call this function as close to the redirect as possible. An example code could look like this:
if (Url.IsLocalUrl(returnUrl)) {
return Redirect(returnUrl);
}
If the issue still persists after using the built-in .NET functionality here, I would recommend proposing a mitigation and discussing it with your organization's Security Team. For more information on how to do this, please refer to the following link: https://docs.veracode.com/r/improve_mitigation.
Thank you,
Florian Walter
I am getting this same problem even though I am matching exactly to how the recommendation to resolve this finding.
if (context != null)
{
if (Url.IsLocalUrl(Data.ReturnUrl))
{
return Redirect(Data.ReturnUrl);
}
}
if (Url.IsLocalUrl(Data.ReturnUrl))
{
return Redirect(Data.ReturnUrl);
}
else if (string.IsNullOrEmpty(Data.ReturnUrl))
{
return Redirect("~/");
}else
{
throw new Exception("invalid return URL");
}
I get flagged for both redirect after checking if local Url.