URL Redirection to Untrusted Site ('Open Redirect')

ID

scala.endpoint.scala_endpoint_rule_unvalidatedredirect

Severity

high

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Endpoint

Language

Scala

Description

Unvalidated redirects occur when an application redirects a user to a destination URL specified by a user supplied parameter that is not validated. Such vulnerabilities can be used to facilitate phishing attacks.

Rationale

Unvalidated redirects occur when an application redirects a user to a destination URL specified by a user supplied parameter that is not validated. Such vulnerabilities can be used to facilitate phishing attacks.

The following code illustrates a vulnerable pattern detected by this rule:

class ReturnToServlet extends HttpServlet {
  @throws[ServletException]
  @throws[IOException]
  override protected def doGet(request: HttpServletRequest, response: HttpServletResponse): Unit = {
    val destination = request.getParameter("returnTo")
    redirect(response, destination)
  }

  @throws[IOException]
  private def redirect(response: HttpServletResponse, destination: String): Unit = {
    // VULNERABLE: URL Redirection to Untrusted Site ('Open Redirect')
    if (destination != null) response.sendRedirect(destination)
  }

  @throws[IOException]
  def redirectToAFixedPath(response: HttpServletResponse): Unit = {
    val destination = "/dashboard"
    if (destination != null) response.sendRedirect(destination)
  }

  def redirectToAFixedPathByHeader(response: HttpServletResponse): Unit = {
    response.addHeader("Location", "/sign-in")
  }
}

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References

© 2026 Xygeni. All rights reserved