How can I mitigate URL redirection attacks?

Question

I have been trying to fix this URL Redirection Attack code block:

String url = '/' + oGenericObj.getDescribe().getKeyPrefix() + '/e';

if (strObject.equals('Quote')) {
    url += '?oppid=' + System.currentPageReference().getParameters().get('oppid');
}

PageReference pEditReference = new PageReference(url);

The particular security scan error occurs for below lines:

1. url += '?oppid=' + System.currentPageReference().getParameters().get('oppid'); and
   
2. PageReference pEditReference = new PageReference(url);

Kindly suggest some ways to solve the errors.

Answer 1

You're allowing the attacker to use any arbitrary input, so they can inject extra parameters, etc. I think what the security scanner is looking for is EncodingUtil.urlEncode:

String url = '/' + oGenericObj.getDescribe().getKeyPrefix() + '/e';
if (strObject.equals('Quote')) {
    url += '?oppid=' + 
      EncodingUtil.urlEncode( 
        System.currentPageReference().getParameters().get('oppid'), 
        'utf-8');
}
PageReference pEditReference = new PageReference(url);

If you ask me, you should also verify that the Id is potentially valid:

String url = '/' + oGenericObj.getDescribe().getKeyPrefix() + '/e';
if (strObject.equals('Quote')) {
    String oppId = System.currentPageReference().getParameters().get('oppid');
    if(oppId instanceOf Id && ((Id)oppId).getSObjectType() == Opportunity.sObjectType) {
        url += '?oppid=' + EncodingUtil.urlEncode(oppId, 'utf-8');
    }
}
PageReference pEditReference = new PageReference(url);