94 lines
2.0 KiB
Plaintext
94 lines
2.0 KiB
Plaintext
User-provided data, such as URL parameters, POST data payloads, or cookies, should always be considered untrusted and tainted. Applications performing HTTP redirects based on tainted data could enable an attacker to redirect users to a malicious site to, for example, steal login credentials.
|
|
|
|
|
|
This problem could be mitigated in any of the following ways:
|
|
|
|
* Validate the user-provided data based on a whitelist and reject input not matching.
|
|
* Redesign the application to not perform redirects based on user-provided data.
|
|
|
|
== Noncompliant Code Example
|
|
|
|
Symfony
|
|
|
|
[source,php]
|
|
----
|
|
public function redirect(Request $request)
|
|
{
|
|
$url = $request->query->get('url');
|
|
return $this->redirect($url); // Noncompliant
|
|
}
|
|
|
|
public function setLocatioHeader(Request $request)
|
|
{
|
|
$url = $request->query->get('url');
|
|
$response = new Response('Redirecting...', 302);
|
|
$response->headers->set('Location', $url); // Noncompliant
|
|
return $response;
|
|
}
|
|
----
|
|
|
|
Laravel
|
|
[source,php]
|
|
----
|
|
public function redirect(Request $request)
|
|
{
|
|
$url = $request->input('url');
|
|
return $this->redirect($url); // Noncompliant
|
|
}
|
|
|
|
public function setLocatioHeader(Request $request)
|
|
{
|
|
$url = $request->input('url');
|
|
return response("", 302)
|
|
->header('Location', $url) // Noncompliant
|
|
}
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
Symfony
|
|
|
|
[source,php]
|
|
----
|
|
public function redirect(Request $request)
|
|
{
|
|
$url = $request->query->get('url');
|
|
$allowedUrls = ["/index", "/login", "/logout"];
|
|
|
|
if (in_array($url, $allowedUrls, true)) {
|
|
return $this->redirect($url);
|
|
} else {
|
|
$this->redirect("/");
|
|
}
|
|
}
|
|
----
|
|
|
|
Laravel
|
|
[source,php]
|
|
----
|
|
public function redirect(Request $request)
|
|
{
|
|
$url = $request->input('url');
|
|
$allowedUrls = ["/index", "/login", "/logout"];
|
|
|
|
if (in_array($url, $allowedUrls, true)) {
|
|
return $this->redirect($url);
|
|
} else {
|
|
return redirect("/");
|
|
}
|
|
}
|
|
----
|
|
|
|
include::../see.adoc[]
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
include::../message.adoc[]
|
|
|
|
include::../highlighting.adoc[]
|
|
|
|
endif::env-github,rspecator-view[]
|