URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)

URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect.

An open redirect vulnerability occurs when an application takes user input and uses it to redirect the user to a different URL. Attackers can exploit this to redirect users to malicious sites.

Prévalence

Moyenne

3 langages couverts

Impact

Moyen

Revue recommandée

Prévention

Documentée

4 exemples de correctifs

2 Prévention

Comment corriger cette vulnérabilité

Stratégies de prévention pour Open Redirect basées sur 4 règles de détection Shoulder.

🐹 Go Tout voir Go détails →

Open Redirect MEDIUM

Validate redirect URLs against an allowlist of trusted domains

+18 -5 go

  package main
  
- import "net/http"
- 
- func handler(w http.ResponseWriter, r *http.Request) {
-     target := r.URL.Query().Get("redirect")
-     // Vulnerable: redirect to user-controlled URL
+ import (
+     "net/http"
+     "net/url"
+ )
+ 
+ var allowedHosts = map[string]bool{
+     "example.com":     true,
+     "app.example.com": true,
+ }
+ 
+ func handler(w http.ResponseWriter, r *http.Request) {
+     target := r.URL.Query().Get("redirect")
+     u, err := url.Parse(target)
+     if err != nil || (u.Host != "" && !allowedHosts[u.Host]) {
+         http.Error(w, "Invalid redirect URL", http.StatusBadRequest)
+         return
+     }
+     // Safe: only allows relative paths or allowed domains
      http.Redirect(w, r, target, http.StatusFound)
  }

🟨 JavaScript Tout voir JavaScript détails →

Next.js Open Redirect MEDIUM

Validate redirect targets against an allowlist of permitted paths

+8 -5 javascript

- export function middleware(request) {
-   const redirectUrl = request.nextUrl.searchParams.get('redirect');
-   if (redirectUrl) {
-     return NextResponse.redirect(redirectUrl);
-   }
+ const ALLOWED_PATHS = ['/login', '/dashboard', '/profile'];
+ 
+ export function middleware(request) {
+   const redirect = request.nextUrl.searchParams.get('redirect');
+   if (redirect && ALLOWED_PATHS.includes(redirect)) {
+     return NextResponse.redirect(new URL(redirect, request.url));
+   }
+   return NextResponse.redirect(new URL('/', request.url));
  }

Open Redirect via Untrusted URLs MEDIUM

Validate redirect URLs against an allowlist or enforce relative paths

+9 -3 javascript

  const express = require('express');
  const app = express();
  
- app.get('/redirect', (req, res) => {
-   const url = req.query.url;
-   res.redirect(url);
+ const ALLOWED_REDIRECTS = ['/home', '/dashboard', '/profile'];
+ 
+ app.get('/redirect', (req, res) => {
+   const url = req.query.url;
+   if (ALLOWED_REDIRECTS.includes(url) || url.startsWith('/')) {
+     res.redirect(url);
+   } else {
+     res.redirect('/home');
+   }
  });

🐍 Python Tout voir Python détails →

Open Redirect MEDIUM

Validate redirect URLs against a domain allowlist or use relative paths

+10 -4 python

  from flask import request, redirect
- 
- @app.route('/goto')
- def goto():
-     url = request.args.get('url')
+ from urllib.parse import urlparse
+ 
+ ALLOWED_DOMAINS = {"myapp.com", "www.myapp.com"}
+ 
+ @app.route('/goto')
+ def goto():
+     url = request.args.get('url', '/')
+     parsed = urlparse(url)
+     if parsed.netloc and parsed.netloc not in ALLOWED_DOMAINS:
+         url = '/'
      return redirect(url)

3 Détection

Trouvez les vulnérabilités dans votre code

Utilisez Shoulder pour scanner votre code à la recherche de patterns URL Redirection to Untrusted Site ('Open Redirect'). 4 règles.

terminal

# Scan with Shoulder CLI
npx @shoulderdev/cli trust --cwe=601

# Or scan entire project
npx @shoulderdev/cli trust .

Règles de Détection (4)

🟨 Javascript 2 rules

Next.js Open Redirect MEDIUM

Detects user-controlled input flowing into redirect targets in Next.js middleware.

Open Redirect via Untrusted URLs MEDIUM

Detects user input flowing into redirect functions without URL validation.

🔷 Typescript 2 rules

Next.js Open Redirect MEDIUM

Detects user-controlled input flowing into redirect targets in Next.js middleware.

Open Redirect via Untrusted URLs MEDIUM

Detects user input flowing into redirect functions without URL validation.

🐹 Go 1 rules

Open Redirect MEDIUM

User-controlled input used in http.Redirect without URL validation.

🐍 Python 1 rules

Open Redirect MEDIUM

Detects unvalidated redirects using user input.

4 Signes d'Alerte

Ce qu'il faut surveiller lors des revues de code

Ces patterns indiquent des vulnérabilités potentielles URL Redirection to Untrusted Site ('Open Redirect'). Recherchez-les lors des revues de code et des audits de sécurité.

🟡

User input flows to redirect without validation go-open-redirect

🟡

user-controlled input flowing into redirect targets in Next javascript-nextjs-open-redirect

🟡

user input flowing into redirect functions without URL validation javascript-open-redirect

🟡

unvalidated redirects using user input python-open-redirect

🔍

Scannez votre base de code pour URL Redirection to Untrusted Site ('Open Redirect')

Shoulder CLI trouve les motifs vulnérables dans toute votre base de code.

npx shoulder trust Parcourir toutes les règles