1

I have been trying to fix the below URL Redirection Attack code block but couldn't find a working solution:

            String url = '/' + oGenericObj.getDescribe().getKeyPrefix() + '/e';
            if (strObject.equals('Quote')) {
                url += '?oppid=' + System.currentPageReference().getParameters().get('oppid');
            }
            PageReference pEditReference = new PageReference(url);

The particular security scan error occurs for below lines:

  1. url += '?oppid=' + System.currentPageReference().getParameters().get('oppid'); and
  2. PageReference pEditReference = new PageReference(url);

Kindly suggest some ways to solve the errors.

5

You're allowing the attacker to use any arbitrary input, so they can inject extra parameters, etc. I think what the security scanner is looking for is EncodingUtil.urlEncode:

String url = '/' + oGenericObj.getDescribe().getKeyPrefix() + '/e';
if (strObject.equals('Quote')) {
    url += '?oppid=' + 
      EncodingUtil.urlEncode( 
        System.currentPageReference().getParameters().get('oppid'), 
        'utf-8');
}
PageReference pEditReference = new PageReference(url);

If you ask me, you should also verify that the Id is potentially valid:

String url = '/' + oGenericObj.getDescribe().getKeyPrefix() + '/e';
if (strObject.equals('Quote')) {
    String oppId = System.currentPageReference().getParameters().get('oppid');
    if(oppId instanceOf Id && ((Id)oppId).getSObjectType() == Opportunity.sObjectType) {
        url += '?oppid=' + EncodingUtil.urlEncode(oppId, 'utf-8');
    }
}
PageReference pEditReference = new PageReference(url);
1
  • That is more clear now. Thanks @sfdcfox! Oct 21 at 14:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.