Hi @JRaman655537 (Community Member)​,

Veracode Static Analysis reports CWE 601 ("Open Redirect") in a frontend application when it can detect that an HTTP request is being triggered while parts of the URL can be controlled from outside the application.

In this particular example, I can see 2 dynamic parts: `this.apiURL` and `equipment`. Since the first one is likely hardcoded in your Angular code, it seems that this might be reported on `equipment`.

I would recommend applying some validation on `equipment`, e.g. making sure if it is alphanumeric (if applicable). An example regex could be `^[a-zA-Z0-9]{1,50}$` (without the ticks). This regex would check for between 1 and 50 alphanumeric characters.

Please note that static analysis cannot evaluate dynamic validation, such as a regex. This means that you would have to propose a mitigation and discuss it with your organization's Security Team. The following article describes how to propose a mitigation: https://docs.veracode.com/r/improve_mitigation

Thank you,

Florian Walter

Thanks Florian for your response.

I have tried below code, still veracode static scan complaints at return this.http.get<EquipmentType[]>(this.apiURL + apiname+"/GetActiveEquipmentTypes") code. Any thoughts? Thanks!

Only HTTP GET and HTTP POST has this issue, HTTP PUT and HTTP DELETE does not have issue. all the HTTP methods have similar codes.

And also in few other applications veracode static scan did not raise similar code as an issue. It is confusing....

  getActiveEquipmentTypes(): Observable<EquipmentType[]> {

    const apiname: string = 'EquipmentType';

    if (apiname.match(/^[a-zA-Z0-9\.]{1,50}$/)  

    && this.apiURL.match(/((([A-Za-z]{3,9}:(?:\/\/)?)(?:[\-;:&=\+\$,\w]+@)?[A-Za-z0-9\.\-]+|(?:www\.|[\-;:&=\+\$,\w]+@)[A-Za-z0-9\.\-]+)((?:\/[\+~%\/\.\w\-_]*)?\??(?:[\-\+=&;%@\.\w_]*)#?(?:[\.\!\/\\\w]*))?)/))

    {

      return this.http.get<EquipmentType[]>(this.apiURL + apiname+"/GetActiveEquipmentTypes")

        .pipe(catchError(this.handleError));

    }

  }

I am sorry to hear that there is some confusion with the scan results. I cannot speak to the reason with the little context I have at this point. Please feel free to reach out to support@veracode.com and provide as much information as possible. Alternatively, also please feel free to schedule a consultation to further discuss this inconsistency with an Application Security Consultant. When doing this, also please make sure to provide as much information in the meeting agenda as possible. This allows my colleagues or me to prepare ourselves as best as possible.

Please also note that static analysis cannot evaluate dynamic validation, such as a regex. This means that you would have to propose a mitigation and discuss it with your organization's Security Team. The following article describes how to propose a mitigation: https://docs.veracode.com/r/improve_mitigation

Thank you,

Florian Walter

I just would like to slightly adjust my initial comment. I misread the code and was of the impression that `equipment` makes it in the URL, but it is of course the HTTP body. This means that `equipment` would certainly not be the reason that this is reported as an Open Redirect. Without having actually seen the corresponding Veracode scan but only this very short snippet, it now seems to me that we merely report it on the `apiUrl` coming potentially from outside the application.

Other than that, this does not change the recommendation.

Thank you,

Florian Walter

Your code indicates that Veracode has identified a potential vulnerability related to open redirects.

Validate the this.apiURL value. and Make sure apiURL is a trusted and validated URL.

Whitelist trusted URLs then validate that the constructed URL using this.apiURL + 'Equipment/' matches one of the whitelisted URLs.

Same thing you can validation on server-side. hope that work

you can verify redirection on any online too such as redirect checker for its redirection chain.