Actions
Task #7805
openRestrict allowed redirect URLs to specific addresses
Start date:
11/27/2024
Due date:
% Done:
0%
Estimated time:
To be discussed:
No
Description
Enhance the redirection logic to allow only explicitly whitelisted URLs or characters, providing a more robust defense against open redirection vulnerabilities.
A previous issue addressed an open redirection vulnerability by disallowing root redirects ("/") and limiting redirects to relative paths. However, there is room to improve security further by explicitly restricting the allowed redirect destinations.
Proposed Solution:
Implement a whitelist-based approach that validates redirect URLs against a predefined set of allowed destinations or characters. This will minimize the risk of vulnerabilities caused by incorrect parsing or unexpected input formats.
Related issues
Updated by Rajmund Hruška 25 days ago
- Related to Bug #7784: Open redirection added
Actions