java.lang.security.audit.unvalidated-redirect.unvalidated-redirect

rules:
  - id: unvalidated-redirect
    message: Application redirects to a destination URL specified by a user-supplied
      parameter that is not validated. This could direct users to malicious
      locations. Consider using an allowlist to validate URLs.
    metadata:
      cwe:
        - "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"
      owasp:
        - A01:2021 - Broken Access Control
      source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNVALIDATED_REDIRECT
      asvs:
        section: "V5: Validation, Sanitization and Encoding Verification Requirements"
        control_id: 5.1.5 Open Redirect
        control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v51-input-validation-requirements
        version: "4"
      category: security
      technology:
        - java
      references:
        - https://owasp.org/Top10/A01_2021-Broken_Access_Control
      subcategory:
        - vuln
      impact: LOW
      likelihood: MEDIUM
      confidence: MEDIUM
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
      vulnerability_class:
        - Open Redirect
    severity: WARNING
    languages:
      - java
    pattern-either:
      - pattern: |
          $X $METHOD(...,HttpServletResponse $RES,...,String $URL,...) {
            ...
            $RES.sendRedirect($URL);
            ...
          }
      - pattern: |
          $X $METHOD(...,String $URL,...,HttpServletResponse $RES,...) {
            ...
            $RES.sendRedirect($URL);
            ...
          }
      - pattern: >
          $X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse
          $RES,...) {
            ...
            String $URL = $REQ.getParameter(...);
            ...
            $RES.sendRedirect($URL);
            ...
          }
      - pattern: >
          $X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest
          $REQ,...) {
            ...
            String $URL = $REQ.getParameter(...);
            ...
            $RES.sendRedirect($URL);
            ...
          }
      - pattern: |
          $X $METHOD(...,String $URL,...) {
            ...
            HttpServletResponse $RES = ...;
            ...
            $RES.sendRedirect($URL);
            ...
          }
      - pattern: >
          $X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse
          $RES,...) {
            ...
            $RES.sendRedirect($REQ.getParameter(...));
            ...
          }
      - pattern: >
          $X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest
          $REQ,...) {
            ...
            $RES.sendRedirect($REQ.getParameter(...));
            ...
          }
      - pattern: |
          $X $METHOD(...,HttpServletResponse $RES,...,String $URL,...) {
            ...
            $RES.addHeader("Location",$URL);
            ...
          }
      - pattern: |
          $X $METHOD(...,String $URL,...,HttpServletResponse $RES,...) {
            ...
            $RES.addHeader("Location",$URL);
            ...
          }
      - pattern: >
          $X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse
          $RES,...) {
            ...
            String $URL = $REQ.getParameter(...);
            ...
            $RES.addHeader("Location",$URL);
            ...
          }
      - pattern: >
          $X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest
          $REQ,...) {
            ...
            String $URL = $REQ.getParameter(...);
            ...
            $RES.addHeader("Location",$URL);
            ...
          }
      - pattern: |
          $X $METHOD(...,String $URL,...) {
            ...
            HttpServletResponse $RES = ...;
            ...
            $RES.addHeader("Location",$URL);
            ...
          }
      - pattern: >
          $X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse
          $RES,...) {
            ...
            $RES.addHeader("Location",$REQ.getParameter(...));
            ...
          }
      - pattern: >-
          $X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest
          $REQ,...) {
            ...
            $RES.addHeader("Location",$REQ.getParameter(...));
            ...
          }