Summary
The public redirect handler currently allows the redir_url query parameter to replace the destination stored for a short link. This means a valid short link can be used to send visitors to an arbitrary external URL.
Impact
This creates an open-redirect risk that could be abused for phishing and misleading link attribution.
Reproduction
Request a valid short link with a redir_url parameter pointing to an unrelated external domain. The response currently uses that parameter as the Location target instead of the stored short-link destination.
Proposed fix
Keep the stored short-link destination authoritative and ignore untrusted redir_url overrides. A regression test should verify that an attacker-controlled value cannot replace the stored destination.
A prepared fix and regression test are available in my fork branch: Sudaisib/dub:fix/4337-untrusted-redirection-url.
Summary
The public redirect handler currently allows the
redir_urlquery parameter to replace the destination stored for a short link. This means a valid short link can be used to send visitors to an arbitrary external URL.Impact
This creates an open-redirect risk that could be abused for phishing and misleading link attribution.
Reproduction
Request a valid short link with a
redir_urlparameter pointing to an unrelated external domain. The response currently uses that parameter as theLocationtarget instead of the stored short-link destination.Proposed fix
Keep the stored short-link destination authoritative and ignore untrusted
redir_urloverrides. A regression test should verify that an attacker-controlled value cannot replace the stored destination.A prepared fix and regression test are available in my fork branch:
Sudaisib/dub:fix/4337-untrusted-redirection-url.