AWS logo
Amazon CodeGuruDetector Library

URL redirection to untrusted site High

An HTTP parameter could contain a URL value and cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker could successfully launch a phishing attack and steal user credentials.

Detector ID
javascript/open-redirect@v1.0
Category
Common Weakness Enumeration (CWE) external icon

Noncompliant example

1var express = require('express')
2var app = express()
3
4function openRedirectNoncompliant() {
5    app.get('/users/:profileUrl',function(req,res){
6        var url = req.params.url
7        // Noncompliant: user input is used without sanitization.
8        res.redirect(url)
9    })
10}

Compliant example

1var express = require('express')
2var app = express()
3
4function openRedirectCompliant() {
5    const safeurl = ['www.example.com']
6    app.post('/users/:profileUrl',function(req,res){
7        var url = req.params.url
8        if(safeurl.includes(url)){
9            // Compliant: user input is sanitized before use.
10            return res.redirect(url)
11        }
12        return res.redirect('/')
13    })
14}