Find open redirects

Finds redirects whose target comes from the HTTP request, which lets an attacker build a link on a trusted site that sends the victim to a site of the attacker's choosing (CWE-601). Sources are servlet request accessors such as getParameter, getHeader, and getQueryString, Spring WebRequest accessors, and Spring MVC handler parameters bound with @RequestParam, @PathVariable, @RequestHeader, and similar, unless typed as a number, boolean, or UUID, or as an array, collection, or Optional of those. The request's own path and URL (getRequestURI, getRequestURL, getPathInfo) are not sources. Sinks are HttpServletResponse#sendRedirect, setHeader and addHeader with the constant header name Location, the URL passed to a Spring RedirectView constructor, a ModelAndView view name that starts with redirect: or with a request value, and JAX-RS Response.seeOther and Response.temporaryRedirect. A redirect: string returned from a controller method is not a sink. A redirect is marked only when a request value decides the start of the redirect target: the target, after any constant text that leaves the host open such as "https://" or "/", starts with a request accessor call, an element of one, or a request-bound parameter, directly or through a local variable, a conditional, string concatenation, a StringBuilder, or a call that keeps the start such as encodeRedirectURL, trim, or URI.create. A request value that only follows a fixed host or path, such as in a query string, or that is passed to another method or stored in a field, is not marked, so redirects built in helper methods or from fields are missed. A redirect is also not marked when every request value in the target is a local variable checked with Collection#contains or Map#containsKey by an if: the redirect is in the branch where the check holds, or follows an if that returns or throws when it fails. Where the collection's contents come from is not checked. Only the checked variable itself counts: a checked value that then passes through a method call or into another variable is still marked. Test sources are not searched.