Reported flaw : This call to javax.servlet.jsp.PageContext.forward() contains a URL redirection to untrusted site flaw. Writing untrusted input into a URL value could cause the web application to redirect the request to the specified URL, leading to phishing attempts to steal user credentials.

I have a jsp where i have a forward function to redirect to another jsp , veracode has reported flaw at the forward line stating the above report, I have used a white list approach to validate the jsp before forwarding by returning the value of string if it matches the white-list, even after this it is still flagging flaw.

Code :

String Jsp = "my.jsp"

String ValidatedJsp = getKnownSafeJsp(Jsp)

public static String getKnownSafeJsp(String url){

if(safeRedirectURLsList!=null && url!=null){

for(String s: safeRedirectURLsList){

if(url.equalsIgnoreCase(s)){

return s;

}}}

return null;

}

static List<String> safeRedirectURLsList = (ArrayList<String>)Arrays.asList(new String[]{

"my.jsp",});

//Forwarding using validatedJsp which will be the returned value from whitelist

<jsp:forward page="<%= ValidatedJsp %>">

<jsp:param name="message" value="we are good" />

</jsp:forward>

Even after following this approach veracode is still flagging it flaw at forward line stating cwe 601, where as if we use a returned value from a whitelist it should mark it as mitigated.