Open Redirect (ARCH8122)
Ce contenu n’est pas encore disponible dans votre langue.
Key kotlin.security.open-redirect · Severity warning · Category security · CWE CWE-601
Flags redirects (“redirect:$url”, response.sendRedirect, call.respondRedirect) whose target comes from request data.
Incorrect
Section titled “Incorrect”return "redirect:${req.getParameter("next")}"Correct
Section titled “Correct”val next = req.getParameter("next")return if (next in allowed) "redirect:$next" else "redirect:/"Allow-list redirect targets, or accept only relative paths.