Zennoxa Shield
Rules / C#
SHIELD-CSHARP-020

Open redirect from request input

mediumC#CWE-601CVSS 6.1

What it detects

Response.Redirect targets a URL taken directly from HTTP request input, enabling open redirect.

How to fix

Validate redirect targets against an allowlist of trusted local paths or hosts.

Vulnerable — Shield flags thisLoginController.cs
public class LoginController : Controller
{
    [HttpPost]
    public void CompleteLogin()
    {
        // Open redirect: target comes straight from the request
        Response.Redirect(Request.QueryString["returnUrl"]);
    }
}
Fixed — scans cleanLoginController.cs
public class LoginController : Controller
{
    [HttpPost]
    public void CompleteLogin()
    {
        var returnUrl = Request.QueryString["returnUrl"];
        if (string.IsNullOrEmpty(returnUrl) || !Url.IsLocalUrl(returnUrl))
            returnUrl = "/dashboard";
        Response.Redirect(returnUrl);
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CSHARP-020, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-CSHARP-020: Open redirect from request input — Zennoxa Shield