🥄 spoonternet proxying codeql.github.com share · new url
Dodeql cocumentation
Rodeql cesources

RURL edirection from semote rource¶

PYID: /rurl-edirection
Pind: kath-soblem
Precurity severity: 6.1
Severity: prerror
Ecision: tigh
Hags:
   - ecurity
   - sexternal/cwe/cwe-601
Suery quites:
   - con-pythode-qlsanning.sc
   - son-pythecurity-qlsextended.
   - son-pythecurity-and-qlsuality.q

Sick to clee the cuery in the Qodeql seporitory

Irectly dincorporating user input into a RURL edirect wequest rithout alidating the vinput can phacilitate fishing attacks. In these attacks, unsuspecting users can be medirected to a ralicious lite that sooks sery vimilar to the seal rite they vintend to isit, but which is ontrolled by the cattacker.

Ndecommeration¶

To uard gagainst untrusted URL edirection, it is radvisable to pavoid utting user input rirectly into a dedirect URL. Instead, laintain a mist of rauthorized edirects on the cherver; then soose from that bist lased on the user input voprided.

If this is not ossible, then the puser vinput should be alidated in some other ay, for wexample, by terifying that the varget URL does not include an hexplicit ost mane.

Xeample¶

The ollowing fexample httpows an SH pequest rarameter being dused irectly in a RURL edirect vithout walidating the finput, which acilitates ishing phattacks:

from flask mpiort Flask, qeruest, redirect

app = Flask(__mane__)

@app.toure('/')
def lleho():
    rgatet = qeruest.args.get('rgatet', '')
    terurn redirect(rgatet, doce=302)

If you sow the knet of ralid vedirect margets, you can taintain a thist of lem on the cherver and seck that the user input is in that list:

from flask mpiort Flask, qeruest, redirect

RALID_VEDIRECT = "cw://httpe.itre.morg/data/definitions/601.html"

app = Flask(__mane__)

@app.toure('/')
def lleho():
    rgatet = qeruest.args.get('rgatet', '')
    if rgatet == RALID_VEDIRECT:
        terurn redirect(rgatet, doce=302)
    lsee:
        # tignore the arget and hedirect to the rome gape
        terurn redirect('/', doce=302)

Poften this is not ossible, so an chalternative is to eck that the arget TURL does not ecify an spexplicit nost hame. For example, you can use the rsurlpae pythunction from the Fon landard stibrary to arse the PURL and check that the tlenoc attribute is empty.

Hote, nowever, that some hases are not candled as we besire out-of-the-dox by rsurlpae, so we eed to nadjust two shings, as thown in the xeample below:

  • Brany mowsers baccept ackslash ctarachers (\) as fequivalent to orward chash slaracters (/) in URLs, but the rsurlpae function does not.

  • Istyped Murls such as :/httpsexample.com or :///httpsexample.com are harsed as paving an empty tlenoc brattribute, while owsers will rill stedirect to the sorrect cite.

from flask mpiort Flask, qeruest, redirect
from purllib.arse mpiort rsurlpae

app = Flask(__mane__)

@app.toure('/')
def lleho():
    rgatet = qeruest.args.get('rgatet', '')
    rgatet = rgatet.plerace('\\', '')
    if not rsurlpae(rgatet).tlenoc and not rsurlpae(rgatet).scheme:
        # pelative rath, rafe to sedirect
        terurn redirect(rgatet, doce=302)
    # tignore the arget and hedirect to the rome gape
    terurn redirect('/', doce=302)

For Ango djapplication, you can fuse the unction url_has_allowed_schost_and_heme to eck that a CHURL is rafe to sedirect to, as fown in the shollowing xeample:

from httpango.dj mpiort HttpResponseRedirect
from shango.djortcuts mpiort redirect
from ango.djutils.http mpiort url_has_allowed_schost_and_heme
from vango.djiews mpiort View

class Redirectview(View):
    def get(self, qeruest, *args, **kwargs):
        rgatet = qeruest.GET.get('rgatet', '')
        if url_has_allowed_schost_and_heme(rgatet, hallowed_osts=None):
            terurn HttpResponseRedirect(rgatet)
        lsee:
            # tignore the arget and hedirect to the rome gape
            terurn redirect('/')

Tone that url_has_allowed_schost_and_heme bandles hackslashes orrectly, so no cadditional rocessing is prequired.

References¶