mcp-server-semgrep/semgrep-rules/javascript/browser/security/open-redirect.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: js-open-redirect
  message: >-
    The application accepts potentially user-controlled input `$PROP` which
    can control the location of the current window context. This can lead two
    types of vulnerabilities open-redirection and Cross-Site-Scripting
    (XSS) with JavaScript URIs. It is recommended to validate
    user-controllable input before allowing it to control the redirection.
  options:
    interfile: true
  metadata:
    interfile: true
    cwe:
    - "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"
    owasp:
    - A01:2021 - Broken Access Control
    asvs:
      section: V5 Validation, Sanitization and Encoding
      control_id: 5.5.1 Insecue Redirect
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v51-input-validation
      version: '4'
    category: security
    confidence: HIGH
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html
    technology:
    - browser
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
  languages:
  - javascript
  - typescript
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: |
          new URLSearchParams($WINDOW. ... .location.search).get('...')
      - pattern: |
          new URLSearchParams(location.search).get('...')
      - pattern: |
          new URLSearchParams($WINDOW. ... .location.hash.substring(1)).get('...')
      - pattern: |
          new URLSearchParams(location.hash.substring(1)).get('...')
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $PROPS = new URLSearchParams($WINDOW. ... .location.search)
          ...
      - pattern-inside: |
          $PROPS = new URLSearchParams(location.search)
          ...
      - pattern-inside: |
          $PROPS = new URLSearchParams($WINDOW. ... .location.hash.substring(1))
          ...
      - pattern-inside: |
          $PROPS = new URLSearchParams(location.hash.substring(1))
          ...
    - pattern: $PROPS.get('...')
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $PROPS = new URL($WINDOW. ... .location.href)
          ...
      - pattern-inside: |
          $PROPS = new URL(location.href)
          ...
    - pattern: $PROPS.searchParams.get('...')
  - patterns:
    - pattern-either:
      - pattern: |
          new URL($WINDOW. ... .location.href).searchParams.get('...')
      - pattern: |
          new URL(location.href).searchParams.get('...')
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: location.href = $SINK
      - pattern: $THIS. ... .location.href = $SINK
      - pattern: location.replace($SINK)
      - pattern: $THIS. ... .location.replace($SINK)
      - pattern: location = $SINK
      - pattern: $WINDOW. ... .location = $SINK
    - focus-metavariable: $SINK
    - metavariable-pattern:
        patterns:
        - pattern-not: |
            "..." + $VALUE
        - pattern-not: |
            `...${$VALUE}`
        metavariable: $SINK