Prevent redirection from URL injection in the Developer Portal

[vernon08]

Hi Everyone,

We have a concern about security vulnerability on our developer portal. It is related to URL injection that allows user to redirect to other sites.

Below is the example URL injection:

https://<hostname>/files/..%5C..%5C..%5CPOC%20HTTP/1.1%0aHost%3A%20example.com%0A%0A

We tried to add the below in the Content Security Policy(CSP) ( Publish -> Portals -> Security -> ); but it is not preventing the redirection. Could you please let us know what is missing? Is there any way to prevent such injection attacks?

- default-src 'unsafe-eval' 'unsafe-inline' * data:
- default-src 'self' 'unsafe-url' 'unsafe-eval' 'unsafe-inline' * data:
- default-src 'self' 'unsafe-url' 'unsafe-eval' 'unsafe-inline' * data: referrer no-referrer

Regards,
Vernon