I have got Query: URL Redirection Attack during Source Scanner.

enter image description here

Piece of controller

public static String forgotPassword(String username, String checkEmailUrl) {
    try {
        ApexPages.PageReference checkEmailRef = new PageReference(checkEmailUrl);
        if(!Site.isValidUsername(username)) {
            return Label.Site.invalid_email;
        return null;
    catch (Exception ex) {
        return ex.getMessage();

in test class

 static void testLightningForgotPasswordControllerInvalidUserName() {
  System.assertEquals(LightningForgotPasswordController.forgotPassword('fakeUser', 'http://a.com'), Label.Site.invalid_email);
  System.assertEquals(LightningForgotPasswordController.forgotPassword(null, 'http://a.com'), Label.Site.invalid_email);
  System.assertEquals(LightningForgotPasswordController.forgotPassword('a', '/home/home.jsp'), Label.Site.invalid_email);

Aura component enter image description here

What I can do with this issue?


2 Answers 2


One way to bypass this is by adding @SuppressWarnings('PMD.ApexOpenRedirect'). But still, this is not a recommended fix.

public static String forgotPassword(String username, String checkEmailUrl) {
    **strong text**try {


  • I believe the post is about the force.com source scanner, which uses checkmarx, and not PMD.. Commented Jun 1, 2021 at 19:37

This is not an exploitable issue, but you should still verify the URL.

Remember that @AuraEnabled methods are callable by the client and their parameters are not under your control. So at a minimum, do a basic check that the host of the url in the CheckEmailURL parameter is the origin you want to send the user to, rather than blindly redirecting based on whatever is passed in from the client.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .