java - Open Redirect violation when using response.sendRedirect()

Question

I'm getting Open Redirect voilation in Fortify & Sonarqube for below lines of code.

    response.sendRedirect(redirectUri);

The variable redirectUri is getting its value from the method parameter.

To resolve this I've added one level of validation.

If the application is running on server then the uri will end with .intranet.mysite.com/. If the application is running on local, the uri will start with http://localhost:8888/.

if (redirectUri.endsWith(".intranet.mysite.com/") || redirectUri.startsWith("http://localhost:8888")) {
    response.sendRedirect(redirectUri);
}

But even after this, I'm getting the violation.

Please suggest, if I'm missing anything.

Thanks.

Answer 1

等待大神答复