javascript - URL 重定向到不受信任的站点

Question

我在 service.ts 文件中有以下代码，VeraCode 代码扫描失败

CWE ID 的缺陷:URL 重定向到不受信任的站点(“Open Redirect”)(CWE ID 601)(16 个缺陷)描述Web 应用程序接受指定外部站点链接的不受信任的输入，并使用该链接生成重定向。这会启用网络钓鱼攻击。

请帮我解决这个问题

服务.ts:

public exportReviews(searchReviewData: SurveillanceReviewSearchViewModel): Observable<SurveillanceReviewSearchViewModel> {
    this._urlSurveillanceDetails = this.baseHref +"/ReviewProfile/ExportReviews";
    const headers: HttpHeaders = new HttpHeaders();
    headers.append('Content-Type', 'application/json');
    return this.http.post<SurveillanceReviewSearchViewModel>(this._urlSurveillanceDetails, searchReviewData, { headers: headers }); // flaw identified on this line
  }

public getReviewsBySearchSessionId(searchsessionId): Observable<SurveillanceReviewSearchViewModel> {
    this._urlSurveillanceDetails = this.baseHref + "/ReviewProfile/SearchReviewsBySessionId" + '?searchsessionId=' + searchsessionId;
    var headers = new HttpHeaders();
    headers.append('Content-Type', 'application/json');
    this._urlSurveillanceDetails = this.sanitizer.sanitize(SecurityContext.RESOURCE_URL, this.sanitizer.bypassSecurityTrustResourceUrl(this._urlSurveillanceDetails));
    return this.http.post<SurveillanceReviewSearchViewModel>(this._urlSurveillanceDetails, headers); // flaw identified on this line
  }

Answer 1

这是误报。请求 url 不是根据不受信任的用户输入或一般用户输入构建的。静态代码分析并不完美，您会到处遇到误报。