Description

This detector identifies unsafe open redirect vulnerabilities in Go applications. Open redirects occur when user-controlled input is used to redirect users to external URLs without proper validation, allowing attackers to redirect victims to malicious sites for phishing attacks or credential theft.

Detection Strategy

• Checks if the Go code imports required HTTP libraries (net/http or github.com/gin-gonic/gin framework)

• Identifies calls to HTTP redirect functions like http.Redirect() or http.RedirectHandler() where the redirect URL may be user-controlled

• Detects unsafe manual header manipulation using response.Header().Set("Location", ...) that could redirect to untrusted URLs

• Finds Gin framework redirect calls that may accept unvalidated user input as the destination URL

• Reports vulnerability when any of these redirect patterns are found without proper URL validation or allowlist checking

Vulnerable code example

package main

import (
	"net/http"
	"github.com/gin-gonic/gin"
)

func unsafeRedirect(w http.ResponseWriter, r *http.Request) {...

✅ Secure code example

package main

import (
	"net/http"
	"strings"
	"github.com/gin-gonic/gin"
)
...