User provided data, such as URL parameters, POST data payloads, or cookies, should always be considered untrusted and tainted. Applications performing HTTP redirects based on tainted data could enable an attacker to redirect users to a malicious site to, for example, steal login credentials.


This problem could be mitigated in any of the following ways:

* Validate the user provided data based on a whitelist and reject input not matching.
* Redesign the application to not perform redirects based on user provided data.

== Noncompliant Code Example

----
$url = $this->request->getQuery("url");
return $this->redirect($url); // Noncompliant
----

== Compliant Solution

----
$whitelist = array(
  "https://www.sonarsource.com/"
);
$url = $this->request->getQuery("url");
if (in_array($url, $whitelist)) {
  return $this->redirect($url);
} else {
  throw new ForbiddenException();
}
----

include::../see.adoc[]
ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

include::../message.adoc[]

include::../highlighting.adoc[]

endif::env-github,rspecator-view[]
