rspec/rules/S6105/javascript/rule.adoc

include::../description.adoc[]

== Noncompliant Code Example

Example of dom open-redirect vulnerability (\http://vulnerable/page.html#https://www.attacker.com/):

----
document.location = document.location.hash.slice(1);
----

== Compliant Solution

The url can be validated with an allowlist:

----
function isValidUrl(url) {
  if(url.startsWith("https://www.example.com/")) {
    return true;
  }

  return false;
}

if(isValidUrl(document.location.hash.slice(1))) {
   document.location = document.location.hash.slice(1);
}
----

include::../see.adoc[]