Open redirect (ARCH2122)

Key python.security.open-redirect · Severity warning · Category security · CWE CWE-601

Taking a redirect target from user input without validation lets attackers run phishing attacks through a trusted domain redirect.

Incorrect

from flask import request, redirect

def go():
    return redirect(request.args["next"])

Correct

from urllib.parse import urlparse
from flask import request, redirect

def go():
    target = request.args["next"]
    if urlparse(target).netloc:
        return redirect("/")
    return redirect(target)

Fix

Restrict redirect targets to relative paths only, or validate them against an allowlist.