PWest421251 (Community Member) asked a question.
We are having an issue where we redirect via javascript due to updated query params. the url is obtained from current url. We are validating the hostname so there is no way this code can redirect to an attackers domain yet veracode still throws the CWE-601. Any suggestions on how we can solve this as it's our last medium issue.
We want to fix this rather than mitigate it as we use veracode pipeline scan to validate no new flaws in a PR.
if (validateURL(url)) {
window.location = DOMPurify.sanitize(url); # this line is throwing the CWE-601
}
}
}
# our validation function
function validateURL(surl) {
var url = new URL(surl);
var urlHostname = url.hostname.trim();
if (urlHostname == '') {
return true;
}
else {
if (urlHostname.toUpperCase() == location.hostname.trim().toUpperCase()) {
return true;
}
else
return false;
}
}
.png){kind=logo}
To address the CWE-601 (Open Redirect) issue reported by the engine and ensure the security of your redirection, it's important to understand how the Veracode scanning engine works and why it flags certain patterns.
The Veracode static analysis engine inspects the data flow of your code for potential security vulnerabilities, including CWE-601, which pertains to improper validation of URLs for redirection. The engine flags code where user-controlled input (in this case, the `url` parameter) is used in a redirection context without comprehensive validation. Even if the hostname is being checked, the engine will still flag this as a potential risk if it detects that parts of the URL could be manipulated by any data that is coming from outside of the binary provided to the platform.
Fixing vs. Mitigating
If your goal is to fix the issue rather than just mitigate it, ensuring that the Veracode engine no longer flags this as a vulnerability you will need to demonstrate that all components of the URL used for redirection are completely within your control (hard-coded) OR cleansed by an industry standard cleanser recognized by the platform. You can see the list of Veracode recognized cleansers here:
https://docs.veracode.com/r/review_cleansers
Unfortunately, there is no recognized industry standard cleanser for CWE-601. Furthermore, complete control of a URL is often challenging, which is why mitigation is a commmonly used along with technical validations for addressing CWE-601 detected flaws.
Suggested Approaches
1. Hard-Code Allowed URLs:
If possible, hard-code the URLs you want to allow for redirection. This completely eliminates the risk of open redirects and is the ony approach the Veracode Engine will recognize as not needing a mitigation.
const allowedUrls = [
'https://example.com/page1',
'https://example.com/page2',
// Add other allowed URLs here
];
function isAllowedUrl(url) {
return allowedUrls.includes(url);
}
if (isAllowedUrl(url)) {
window.location = allowedUrls[allowedUrls.indexOf(url)]; // This will be considered safe by Veracode
}
2. Use a Whitelist for Hostnames
If hard-coding full URLs is impractical, use a whitelist for allowed hostnames and ensure the entire URL structure is validated, given the intended functionality of the Veracode engine, this will still require mitigation by design.
const allowedHostnames = ['example.com'];
function validateURL(surl) {
try {
const url = new URL(surl);
const urlHostname = url.hostname.trim().toLowerCase();
const currentHostname = location.hostname.trim().toLowerCase();
if (allowedHostnames.includes(urlHostname) && urlHostname === currentHostname) {
return true;
}
} catch (e) {
// Handle invalid URLs
}
return false;
}
if (validateURL(url)) {
window.location = DOMPurify.sanitize(url); // Ensure DOMPurify is configured correctly
}
I hope this provides you with a viable path forward, if you need further assistance, please feel free to reach out.
---