MKim147913 (Community Member) asked a question.
How to fix CWE 601 URL Redirection to Untrusted Site('Open Redirect') for Android?
The app uses the loadUrl function to transfer information from the app to the web. A defect was found in the veracode result report, so I added logic to check its validity, but it still came out as a defect. How do I fix this?
It was discovered in two places.
1. Information delivery via web URL - webView.loadUrl(it ?: webUrl, mapOf("User-Agent" to Constant.USER_AGENT))
- Modified to check web url(it)
2. Passing string value for callback - it.post { it.loadUrl(callbackStr)
- Passed only if it starts with javascript
if(callbackStr.matches(Regex("^javascript:.*$", RegexOption.DOT_MATCHES_ALL)))
Please provide guidance on how to fix it.
.png){kind=logo}
Hi @MKim147913 (Community Member) ,
I would recommend you contact our technical support team. Here's how you can log a case:
1. Navigate to the upper right corner of any page in the Community, click on your user avatar.
2. Select Contact Support from the drop-down menu.
In your support case please provide a URL to the Veracode Platform where the flaws can be found ( typically starts with https://analysiscenter.veracode.com/auth/index.jsp#ReviewResultsStaticFlaws: ) and a flaw ID.
Thank you,
Boy Baukema