rspec/rules/S6105/javascript/rule.adoc

DOM open redirect vulnerabilities occur when user-controlled data like the ``++document.location.hash++`` property is directly used to perform redirections.


User-controlled data should always be considered untrusted and validated before being used to modify the DOM.


== Noncompliant Code Example

Example of DOM open redirect vulnerability (``++http://vulnerable/page.html#\https://www.attacker.com/++``):

----
document.location = document.location.hash.slice(1);
----


== Compliant Solution

The URL can be validated with an allowlist:

----
function isValidUrl(url) {
  if(url.startsWith("https://www.example.com/")) {
    return true;
  }

  return false;
}

if(isValidUrl(document.location.hash.slice(1))) {
   document.location = document.location.hash.slice(1);
}
----


== See

* https://www.owasp.org/index.php/Top_10-2017_A5-Broken_Access_Control[OWASP Top 10 2017 Category A5] - Broken Access Control
* https://cwe.mitre.org/data/definitions/601.html[MITRE, CWE-601] - URL Redirection to Untrusted Site ('Open Redirect')
* https://www.sans.org/top25-software-errors/#cat2[SANS Top 25] - Risky Resource Management