mcp-server-semgrep
Version:
MCP Server for Semgrep Integration - static code analysis with AI
32 lines (28 loc) • 1.22 kB
JavaScript
/*
* Copyright (c) 2014-2020 Bjoern Kimminich.
* SPDX-License-Identifier: MIT
*/
const utils = require('../lib/utils')
const insecurity = require('../lib/insecurity')
const challenges = require('../data/datacache').challenges
module.exports = function performRedirect () {
return ({ query }, res, next) => {
const toUrl = query.to
if (insecurity.isRedirectAllowed(toUrl)) {
utils.solveIf(challenges.redirectCryptoCurrencyChallenge, () => { return toUrl === 'https://explorer.dash.org/address/Xr556RzuwX6hg5EGpkybbv5RanJoZN17kW' || toUrl === 'https://blockchain.info/address/1AbKfgvw9psQ41NbLi8kufDQTezwG8DRZm' || toUrl === 'https://etherscan.io/address/0x0f933ab9fcaaa782d0279c300d73750e1311eae6' })
utils.solveIf(challenges.redirectChallenge, () => { return isUnintendedRedirect(toUrl) })
// ruleid:unknown-value-in-redirect
res.redirect(toUrl)
} else {
res.status(406)
next(new Error('Unrecognized target URL for redirect: ' + toUrl))
}
}
}
function isUnintendedRedirect (toUrl) {
let unintended = true
for (const allowedUrl of insecurity.redirectWhitelist) {
unintended = unintended && !utils.startsWith(toUrl, allowedUrl)
}
return unintended
}