經得起原始碼資安弱點掃描的程式設計習慣培養(十七)_OPEN_REDIRECT
pen redirect (OPEN_REDIRECT) sink: Calling Redirect. This call passes the tainted data, ....... (The virtual call resolves to System.Web.Mvc.Controller.Redirect(System.String).) 開放式重定向(釣魚攻擊)，頁面跳轉過程並未驗證重定向目的網址是否安全。 Before 1 2 3 4 5 6 public async Task<ActionResult> Login(LoginViewModel model, string returnUrl) { [perform auth logic] return this .Redirect(returnUrl); } After 1 2 3 4 5 6 7 8 9 10 11 12 13 public async Task<ActionResult> Login(LoginViewModel model, string returnUrl) { [perform auth logic] if (Url.IsLocalUrl(returnUrl)) { return this .Redirect(returnUrl); } else { return RedirectToAction ( "Index" , "Home" ); } }一 一般來說除了驗證是否為本機路徑(非絕對路徑)，以確保攻擊者無法將使用者重新導向到惡意外部網域，也能用以下確認是相對路徑(不是絕對路徑)方式來加強驗證 After2. 1 2 3 4 5 6 7 8 9 10 Uri targetUri = null ; if (Uri.TryCreate(Request.QueryString[ "ReturnUrl" ], UriKind.Relative, out targetUri)) { Response.Redir...
