
ASachan159002 (Community Member) asked a question.
Why I am getting this warning at line 17 - <jsp:forward page="invalidUser.jsp"> ? I have whitelisted invalidUser page and then hardcoded also as this warning not going away - Pls refer code
<%@ page import="org.apache.commons.codec.CharEncoding" %>
<%@ page import="java.net.URLEncoder" %>
<%@ page import="java.util.Arrays" %>
<%@ page import="java.util.List" %>
<%
String user = (String)session.getAttribute("loginUser");
String invalidUserPage = "invalidUser.jsp";
String loggerPage = "logger.jsp";
// Define a whitelist of trusted pages
List<String> trustedPages = Arrays.asList("invalidUser.jsp", "logger.jsp");
if(user == null) {
String failReason = (String)request.getAttribute("failReason");
if (trustedPages.contains(invalidUserPage)) {
%>
<jsp:forward page="invalidUser.jsp">
<jsp:param value="<%=failReason%>" name="failReason" />
</jsp:forward>
<%
} else {
response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Invalid redirect URL");
}
} else {
String type = (String)session.getAttribute("userType");
if(!type.equalsIgnoreCase("superadmin")) {
if (trustedPages.contains(loggerPage)) {
%>
<jsp:forward page="logger.jsp" />
<%
} else {
response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Invalid redirect URL");
}
}
}
%>
.png)
Hi there! I'd suggest considering scheduling a consultation call to go over specific examples and discuss your implementation in detail.
https://docs.veracode.com/r/t_schedule_consultation