Web applicaitons that send redirects should neutralize any values taken from a request before using them in redirects. Failing to do so could make it easier for attackers to launch phishing attacks from your site.


This rule checks that values extracted from a request are not unconditionally used directly in a redirect or other header fields.


== Noncompliant Code Example

----
protected void doGet(HttpServletRequest request, HttpServletResponse response) 
      throws ServletException, IOException {
  // ...
  String url = request.getParameter("url");
  response.sendRedirect(url);  // Noncompliant; request value used directly in redirect
----


== Compliant Solution

----
protected void doGet(HttpServletRequest request, HttpServletResponse response) 
      throws ServletException, IOException {
  // ...
  String url = request.getParameter("url");
  if (url.matches(OKAY_URL_REGEX)) {
    response.sendRedirect(url);  // Compliant; value used conditionally
  }
----
or

----
protected void doGet(HttpServletRequest request, HttpServletResponse response) 
      throws ServletException, IOException {
  // ...
  String url = request.getParameter("url");
  response.sendRedirect(scrubRedirect(url));  // Compliant; method presumed to sanitize input
----


== See

* https://www.owasp.org/index.php/Top_10-2017_A7-Cross-Site_Scripting_(XSS)[OWASP Top 10 2017 Category A7] - Cross-Site Scripting (XSS)
* https://cwe.mitre.org/data/definitions/601[MITRE, CWE-601] - URL Redirection to Untrusted Site
* https://www.sans.org/top25-software-errors/#cat1[SANS Top 25] - Insecure Interaction Between Components
* Derived from FindSecBugs rule https://h3xstream.github.io/find-sec-bugs/bugs.htm#UNVALIDATED_REDIRECT[Unvalidated Redirect]

