grandnode2
grandnode2 copied to clipboard
Fix code scanning alert no. 237: URL redirection from remote source
Fixes https://github.com/grandnode/grandnode2/security/code-scanning/237
To fix the problem, we need to ensure that the returnUrl parameter is validated to prevent open redirection attacks. Specifically, we should check if the returnUrl is a local URL before using it in a redirect. If it is not a local URL, we should redirect to a safe default URL.
- Add a check using
Url.IsLocalUrl(returnUrl)in theChangeStoremethod. - If the
returnUrlis not local, set it to a safe default URL. - This change should be made in the
ChangeStoremethod in the filesrc/Web/Grand.Web.Admin/Controllers/HomeController.cs.
Suggested fixes powered by Copilot Autofix. Review carefully before merging.