Abhishek M (Community Member) asked a question.
Reported flaw : This call to javax.servlet.jsp.PageContext.forward() contains a URL redirection to untrusted site flaw. Writing untrusted input into a URL value could cause the web application to redirect the request to the specified URL, leading to phishing attempts to steal user credentials.
I have a jsp where i have a forward function to redirect to another jsp , veracode has reported flaw at the forward line stating the above report, I have used a white list approach to validate the jsp before forwarding by returning the value of string if it matches the white-list.
Code :
String Jsp = "my.jsp"
String ValidatedJsp = getKnownSafeJsp(Jsp)
public static String getKnownSafeJsp(String url){
if(safeRedirectURLsList!=null && url!=null){
for(String s: safeRedirectURLsList){
if(url.equalsIgnoreCase(s)){
return s;
}
}
}
static List<String> safeRedirectURLsList = (ArrayList<String>)Arrays.asList(new String[]{
"my.jsp",});
return null;
}
.png){kind=logo}
Hi @Abhishek M (Community Member)
I think the code looks good and it appears that Allow-list is correctly implemented as well.
Only thing that safeRedirectURLsList should declared outside of function getKnownSafeJsp() and it should return a known default 'url' if the condition fails or throw an exception (InvalidForwardUrlException) to the caller of the method to manage the risk there.
We would need more details to review whether this is a False positive finding or not.
I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Regards,
Kashif
Yes safeRedirectURLsList is outside getKnownSafeJsp method, getKnownSafeJsp takes the url as parameter it checks if it matches in the white list "safeRedirectURLsList" , if it matches it will return the value if not it will return null , sorry for the above typo * , i am applying this method to validate my.jsp before using it in forward function , if getKnownSafeJsp returns a value we will proceed to use the value in the forward function.
<jsp:forward page="<%= ValidatedJsp %>">
<jsp:param name="message" value="hello" />
</jsp:forward>
We would need more details to review whether this is a False positive finding or not.
I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Regards,
Kashif
Like
Reply