MFisher589734 (Community Member) asked a question.
The J2EE specification says about this method:
Reconstructs the URL the client used to make the request. The returned URL contains a protocol, server name, port number, and server path, but it does not include query string parameters.
…
This method is useful for creating redirect messages and for reporting errors.
Note from the specification: “servlet path” in J2EE “… does not include any extra path information or a query string”. So an attacker cannot add extra characters that might cause trouble. The getRequestURL() will strip off any additional characters from the request.
Our application would not have received this request to process unless it has a safe and valid server path. All requests have to route through a reverse proxy, load balancer, web server, then J2ee container before reaching our application.
.png){kind=logo}
Hi @MFisher589734 (Community Member) ,
This depends a lot on how request.getRequestURL is used. Something like the following would be fine:
response.sendRedirect(request.getRequestURI());
However, something like this is not:
// Takes something like "http://example.com/redirect/to/example.com" and turns it into "example.com"
String domain = request.getRequestURL().substring(request.getRequestURL().lastIndexOf("/"));
response.sendRedirect(domain);
To Veracode Static Analysis it is impossible to see how this value is used and if it is used correctly so we recommend manually reviewing and if it is used appropriately documenting this in a mitigation proposal ( https://docs.veracode.com/r/improve_mitigation ) and contacting your security team to ask them to review your proposal.
If you're unsure, I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Thank you,
Boy Baukema