How to fix Request.QueryString open redirect issue in asp.net

Question

User42464830 posted

I am trying to fix the open redirect issue from fortify for the below lines of code:

    public string Reference
    {
        get
        {
            string reference = null;
            if (Request.QueryString["reference"] != null)
                reference = Request.QueryString["reference"].ToString();
            return reference;
        }
    }

Tried to set some validation while using it like:

   if (Int32.TryParse(this.StatusCode.ToString(), out int val) && !string.IsNullOrEmpty(this.Reference))
                this.Response.Redirect(
                        string.Format("fSometail.aspx?reference={0}&statuscode={1}&recurring={2}",
                        this.Reference, val, this.Recurring ? 1 : 0),
                    true); 

But it is still not resolved. Please let me know if anyone knows the fix for this.

Here is what fortify says: In this case, the URL the client will be redirected to is accepted at get_QueryString() in fsomepage.aspx.cs at line 356.

Answer 1

User753101303 posted

Hi,

Fortify doesn't have a doc which explains exactly how the rule is triggered and how to fix it?

Assuming it is detecting the use of Redirect with anything coming from a user controlled value, try something such as  https://docs.microsoft.com/en-us/dotnet/api/system.web.webpages.httpcontextextensions.redirectlocal?view=aspnet-webpages-3.2 instead. I would expect this to throw if not directing the user to the same host name or application.

The general idea is to have a safe replacement which prevents what Fortify warn against. You can then tell Fortiy this method doesn't have this particular issue and use that method instead where Forify shows this issue. Here the idea is to be 100% sure that the user is directed to the same site rather than to a 3rd party site.

Edit: it does something such as

https://github.com/aspnet/AspNetWebStack/blob/42991b3d2537b702736463f76a10a4fcf2ea44c9/src/System.Web.WebPages/HttpContextExtensions.cs