33 lines
888 B
Plaintext
33 lines
888 B
Plaintext
|
=== How to fix it in DOM API
|
||
|
|
|
||
|
|
include::../../common/fix/code-rationale.adoc[]
|
||
|
|
|
||
|
|
==== Noncompliant code example
|
||
|
|
|
||
|
|
The following example is vulnerable to open redirection through the following URL: `\https://example.com/redirect?url=https://evil.com`;
|
||
|
|
|
||
|
|
[source,javascript,diff-id=1,diff-type=noncompliant]
|
||
|
|
----
|
||
|
|
const queryParams = new URLSearchParams(document.location.search);
|
||
|
|
const redirectUrl = queryParams.get("url");
|
||
|
|
document.location = redirectUrl; // Noncompliant
|
||
|
|
----
|
||
|
|
|
||
|
|
==== Compliant solution
|
||
|
|
|
||
|
|
[source,javascript,diff-id=1,diff-type=compliant]
|
||
|
|
----
|
||
|
|
const queryParams = new URLSearchParams(document.location.search);
|
||
|
|
const redirectUrl = queryParams.get("url");
|
||
|
|
|
||
|
|
if (redirectUrl.startsWith("https://www.example.com/")) {
|
||
|
|
document.location = redirectUrl;
|
||
|
|
}
|
||
|
|
----
|
||
|
|
|
||
|
|
include::../../common/fix/how-does-this-work.adoc[]
|
||
|
|
|
||
|
|
=== Pitfalls
|
||
|
|
|
||
|
|
include::../../common/pitfalls/starts-with.adoc[]
|