35 lines
906 B
Plaintext
35 lines
906 B
Plaintext
== How to fix it in DOM API
|
|
|
|
=== Code examples
|
|
|
|
include::../../common/fix/code-rationale.adoc[]
|
|
|
|
==== Noncompliant code example
|
|
|
|
The following example is vulnerable to open redirection through the following URL: `\https://example.com/redirect?url=https://evil.com`;
|
|
|
|
[source,javascript,diff-id=1,diff-type=noncompliant]
|
|
----
|
|
const queryParams = new URLSearchParams(document.location.search);
|
|
const redirectUrl = queryParams.get("url");
|
|
document.location = redirectUrl; // Noncompliant
|
|
----
|
|
|
|
==== Compliant solution
|
|
|
|
[source,javascript,diff-id=1,diff-type=compliant]
|
|
----
|
|
const queryParams = new URLSearchParams(document.location.search);
|
|
const redirectUrl = queryParams.get("url");
|
|
|
|
if (redirectUrl.startsWith("https://www.example.com/")) {
|
|
document.location = redirectUrl;
|
|
}
|
|
----
|
|
|
|
include::../../common/fix/how-does-this-work.adoc[]
|
|
|
|
=== Pitfalls
|
|
|
|
include::../../common/pitfalls/starts-with.adoc[]
|