Rule Definition
Attackers may use phishing techniques or steal credentials. URL redirection to untrusted site (second order) - The application stores data in a database. At a later time, the data is subsequently read back into the application and included in an URL redirection method without sanitization.

Remediation
Assume all input is malicious. Avoid using inputs. If it is not possible, use an "accept known good" input validation strategy, i.e., use stringent white-lists that limit the character set based on the expected value of the parameter in the request. This will indirectly limit the scope of an attack.

Violation Code Sample

...
resultSet = preparedStatement.executeQuery();
String url = resultSet.getString(1);
...
response.sendRedirect(url);

Fixed Code Sample

...
resultSet = preparedStatement.executeQuery();
String url = resultSet.getString(1);
//insert a call to a strong validation code for the input received "url"
cleanedUrl = mySanitization(url);
...
response.sendRedirect(cleanedUrl);

CWE-601: URL Redirection to Untrusted Site ('Open Redirect') https://cwe.mitre.org/data/definitions/601.html Open Web Application Security Project (OWASP) https://www.owasp.org/index.php/Top_10_2013-A10-Unvalidated_Redirects_and_Forwards