daniel-teuchert-sonarsource 58f256f85c
Modify rule S5146: Add fix for Blazor (APPSEC-1905) (#4128)
Co-authored-by: Thomas Serre <118730793+thomas-serre-sonarsource@users.noreply.github.com>
2024-09-02 14:56:08 +02:00

51 lines
953 B
Plaintext

== How to fix it in Blazor
=== Code examples
include::../../common/fix/code-rationale.adoc[]
==== Noncompliant code example
[source,csharp,diff-id=2,diff-type=noncompliant]
----
@page "/"
@inject NavigationManager Navigation
@code {
[SupplyParameterFromQuery]
private String url {get ; set; }
protected override void OnInitialized() {
Navigation.NavigateTo(url);
}
}
----
==== Compliant solution
[source,csharp,diff-id=2,diff-type=compliant]
----
@page "/"
@inject NavigationManager Navigation
@code {
[SupplyParameterFromQuery]
private String url {get ; set; }
private readonly string[] allowedUrls = { "/", "/login", "/logout" };
protected override void OnInitialized() {
if (allowedUrls.Contains(url))
{
Navigation.NavigateTo(url);
}
}
}
----
include::../../common/fix/how-does-this-work.adoc[]
=== Pitfalls
include::../../common/pitfalls/starts-with.adoc[]