ASachan159002 (Community Member) asked a question.

URL Redirection to Untrusted Site ('Open Redirect') CWE ID 601 - warning not going away despite of whitelisting and hardcoding - Pls refer details

Why I am getting this warning at line 17 - <jsp:forward page="invalidUser.jsp"> ? I have whitelisted invalidUser page and then hardcoded also as this warning not going away - Pls refer code

 

<%@ page import="org.apache.commons.codec.CharEncoding" %>

<%@ page import="java.net.URLEncoder" %>

<%@ page import="java.util.Arrays" %>

<%@ page import="java.util.List" %>

<%

String user = (String)session.getAttribute("loginUser");

String invalidUserPage = "invalidUser.jsp";

String loggerPage = "logger.jsp";

 

// Define a whitelist of trusted pages

List<String> trustedPages = Arrays.asList("invalidUser.jsp", "logger.jsp");

 

if(user == null) {

String failReason = (String)request.getAttribute("failReason");

if (trustedPages.contains(invalidUserPage)) {

%>

<jsp:forward page="invalidUser.jsp">

<jsp:param value="<%=failReason%>" name="failReason" />

</jsp:forward>

<%

} else {

response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Invalid redirect URL");

}

} else {

String type = (String)session.getAttribute("userType");

if(!type.equalsIgnoreCase("superadmin")) {

if (trustedPages.contains(loggerPage)) {

%>

<jsp:forward page="logger.jsp" />

<%

} else {

response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Invalid redirect URL");

}

}

}

%>

 


Topics (5)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.