Hello @Benny WOng (Community Member)​ ,

Veracode Static Analysis reports flaws of CWE-601: URL Redirection to Untrusted Site ('Open Redirect') if it can detect a redirect to a path constructed using tainted data . The concern is that an attacker may be able to abuse this tainted data to cause your application to redirect to an attacker controlled domain.

The general recommendation is to use hardcoded URL values (optionally select a hardcoded value from a map / whitelist of hardcoded valid URLs). If you are able to ensure that all dynamic input in the redirect URL, traces back to a hardcoded value, then Veracode Static Analysis will be able to automatically close the flaw.

If you must use dynamic values from outside of the application, we recommend applying validation on any dynamic input into URLs used for redirection. However, Veracode Static Analysis is blind to custom validation and will not automatically close flaws based on custom validation. In this case, it would need to be fixed by a manual mitigation on the Veracode Platform.

In the example above, workspaceId is validated using a Regex check but the apiPath is not validated. We would recommend implementing checks on the apiPath variable also (using Regex/ whitelisting approach) and raising a Mitigation by design on the Veracode Platform documenting the validations in place, and contact the security team in your organization for approval.

Reference: https://docs.veracode.com/r/improve_mitigation

You can also find more information on this category of flaws in our community article :

https://www.veracode.com/security/dotnet/cwe-601

https://www.veracode.com/security/java/cwe-601

Regards,

Sounderya

Hello @Sounderya, Security Consultant (Veracode, Inc.)​ ,

Thanks for your reply.

The apiPath in the example is hardcoded URL from angular environment.

private apiPath: string = `${environment.serverHost}/api/chat-conversations`;

Therefore, for my case, I just need to validate the workspaceId and raise mitigation by design on the Veracode Platform, right?

Regards,

Benny Wong

Hello @Sounderya, Security Consultant (Veracode, Inc.)​ ,

load(pageIndex: number, limit: number, filters: any[]): Observable<any> {

const query = this.buildQuery(pageIndex, limit, filters);

return this._http.get(`${this.apiPath}${query}`);

}

The bold line is violated the CWE 601 in veracode scanning. The apiPath is hardcoded, so I think I need to implement checking on query. However, there is a use case that the user may search url in the content.

i.e. query = ' content = "www.example.com" ';

In the above line, content = is generated by program, www.example.com is input by user.

For this case, how can I fulfil the user requirement and fix the CWE601 issue at the same time?