Project

General

Profile

Actions

Task #7805

open

Restrict allowed redirect URLs to specific addresses

Added by Rajmund Hruška 25 days ago.

Status:
New
Priority:
Normal
Assignee:
-
Category:
Development - GUI
Target version:
Start date:
11/27/2024
Due date:
% Done:

0%

Estimated time:
To be discussed:
No

Description

Enhance the redirection logic to allow only explicitly whitelisted URLs or characters, providing a more robust defense against open redirection vulnerabilities.

A previous issue addressed an open redirection vulnerability by disallowing root redirects ("/") and limiting redirects to relative paths. However, there is room to improve security further by explicitly restricting the allowed redirect destinations.

Proposed Solution:
Implement a whitelist-based approach that validates redirect URLs against a predefined set of allowed destinations or characters. This will minimize the risk of vulnerabilities caused by incorrect parsing or unexpected input formats.


Related issues

Related to Mentat - Bug #7784: Open redirectionClosedRajmund Hruška09/17/2024

Actions
Actions

Also available in: Atom PDF