Security: Open Redirect Vulnerability in Redirect Endpoint

[tuanaiseo]

Problem

The redirect endpoint at src/controllers/kitchen-sink/redirect.controllers.js allows arbitrary URL redirection. While there is a validator using isURL(), this validation can be bypassed with certain URL formats (e.g., data: URLs, javascript: URLs, or other protocols). An attacker could craft a malicious URL to redirect users to phishing sites.

Severity: high
File: src/controllers/kitchen-sink/redirect.controllers.js

Solution

Implement a whitelist of allowed domains or use a URL parsing library to validate and restrict redirects to internal domains only. Consider using a function like: const allowedDomains = ['example.com', 'localhost']; const parsedUrl = new URL(url); if (!allowedDomains.includes(parsedUrl.hostname)) return res.status(400).json({error: 'Invalid redirect URL'});

Changes

• src/controllers/kitchen-sink/redirect.controllers.js (modified)

Testing

• Existing tests pass
• Manual review completed
• No new warnings/errors introduced