Redirect

ID

ruby.checkredirect

Severity

low

Resource

Redirect

Language

Ruby

Description

URL redirection to untrusted site ('Open Redirect').

Open Redirect vulnerabilities occur when web applications dynamically construct URLs for redirection using user inputs, without proper validation or constraints. These vulnerabilities can be exploited by attackers to redirect users to phishing sites, steal personal information, or perform malicious actions.

Rationale

Looks for calls to redirect_to with user input as arguments

Remediation

If possible, avoid using (client-side) redirects and (server-side) forwards unless strictly necessary.

Otherwise, to mitigate Open Redirect vulnerabilities, apply these best practices:

  1. Whitelist URLs: Restrict redirection targets to a predefined list of trusted URLs. Only allow redirections to URLs that have been explicitly marked as safe or necessary for application functionality. Another option is to use a map of allowed URLs or domains and use an indirect reference from the request to choose a valid redirect URL from the map.

  2. Input Validation and Normalization: When constructing redirection URLs, validate and normalize the user inputs. Ensure the inputs conform to expected patterns, such as being a relative URL and not containing prohibited protocols or domains.

  3. Avoid Using sendRedirect for User-Controlled Paths: Prefer using server-side routing logic that does not involve dynamic user-generated paths or URLs for redirection purposes.

  4. Security Awareness and User Warnings: Inform users of potential risks when following redirects, and warn them against entering sensitive information on unfamiliar sites.

  5. Regular Security Audits and SAST: Conduct periodic security audits of the codebase and utilize SAST tools to detect and address Open Redirect vulnerabilities throughout the software development lifecycle.

By implementing these strategies, you can effectively reduce the risk of open redirect vulnerabilities, thereby safeguarding user interactions and maintaining the integrity of your application’s navigational logic.

Configuration

This detector does not need any configuration.

References