C#: update the QHelp for cs/web/unvalidated-url-redirection

[erik-krogh]

I used the examples from the JS QHelp, and adapted them to the C# QHelp.

The examples should not give any false positives now that #15596 has been merged.

[github-actions]

QHelp previews:

csharp/ql/src/Security Features/CWE-601/UrlRedirect.qhelp

URL redirection from remote source

Directly incorporating user input into a URL redirect request without validating the input can facilitate phishing attacks. In these attacks, unsuspecting users can be redirected to a malicious site that looks very similar to the real site they intend to visit, but which is controlled by the attacker.

Recommendation

To guard against untrusted URL redirection, it is advisable to avoid putting user input directly into a redirect URL. Instead, maintain a list of authorized redirects on the server; then choose from that list based on the user input provided.

If this is not possible, then the user input should be validated in some other way, for example, by verifying that the target URL is on the same host as the current page.

Example

The following example shows an HTTP request parameter being used directly in a URL redirect without validating the input, which facilitates phishing attacks:

using System;
using System.Web;

public class UnvalidatedUrlHandler : IHttpHandler
{
    public void ProcessRequest(HttpContext ctx)
    {
        // BAD: a request parameter is incorporated without validation into a URL redirect
        ctx.Response.Redirect(ctx.Request.QueryString["page"]);
    }
}

One way to remedy the problem is to validate the user input against a known fixed string before doing the redirection:

using System;
using System.Web;
using System.Collections.Generic;

public class UnvalidatedUrlHandler : IHttpHandler
{
    private List<string> VALID_REDIRECTS = new List<string>{ "http://cwe.mitre.org/data/definitions/601.html", "http://cwe.mitre.org/data/definitions/79.html" };

    public void ProcessRequest(HttpContext ctx)
    {
        if (VALID_REDIRECTS.Contains(ctx.Request.QueryString["page"]))
        {
            // GOOD: the request parameter is validated against a known list of strings
            ctx.Response.Redirect(ctx.Request.QueryString["page"]);
        }
    }
}

Alternatively, we can check that the target URL does not redirect to a different host by checking that the URL is either relative or on a known good host:

using System;
using System.Web;

public class UnvalidatedUrlHandler : IHttpHandler
{
    public void ProcessRequest(HttpContext ctx)
    {
        var urlString = ctx.Request.QueryString["page"];
        var url = new Uri(urlString, UriKind.RelativeOrAbsolute);

        var url = new Uri(redirectUrl, UriKind.RelativeOrAbsolute);
        if (!url.IsAbsoluteUri) {
            // GOOD: The redirect is to a relative URL
            ctx.Response.Redirect(url.ToString());
        }

        if (url.Host == "example.org") {
            // GOOD: The redirect is to a known host
            ctx.Response.Redirect(url.ToString());
        }
    }
}

Note that as written, the above code will allow redirects to URLs on example.com, which is harmless but perhaps not intended. You can substitute your own domain (if known) for example.com to prevent this.

References

• OWASP: XSS Unvalidated Redirects and Forwards Cheat Sheet.
• Microsoft Docs: Preventing Open Redirection Attacks (C#).
• Common Weakness Enumeration: CWE-601.

[michaelnebel]

Thank you!

[michaelnebel]

nit: Use the brand new C# 12 collection expression language feature

Suggested change

	private List<string> VALID_REDIRECTS = new List<string>{ "http://cwe.mitre.org/data/definitions/601.html", "http://cwe.mitre.org/data/definitions/79.html" };
	private List<string> VALID_REDIRECTS = ["http://cwe.mitre.org/data/definitions/601.html", "http://cwe.mitre.org/data/definitions/79.html"];

[erik-krogh]

I prefer not to use language features that are that new.