Potential fix for code scanning alert no. 316: URL redirection from remote source

[KrzysztofPajak]

Potential fix for https://github.com/grandnode/grandnode2/security/code-scanning/316

In general, the safest fix is to never pass the raw user input directly to Redirect. Instead, validate the input and construct a new, trusted redirect URL based on the result of that validation. A common pattern is to introduce a separate local variable (e.g., redirectUrl) that is initialized with a safe default and only ever assigned validated values (such as a local URL or a known-good route), leaving the original user input unchanged.

For this specific case in SetStore (lines 248–273), the logic is already doing a local URL check, but it reuses the returnUrl variable for both the untrusted input and the trusted redirect target. To make the code clearer and more robust, we should:

• Introduce a new variable, e.g. redirectUrl, set initially to Url.RouteUrl("HomePage").
• If Url.IsLocalUrl(returnUrl) is true, assign redirectUrl = returnUrl; otherwise leave it as the safe default.
• Call return Redirect(redirectUrl); instead of Redirect(returnUrl).

This change occurs only within SetStore in src/Web/Grand.Web/Controllers/CommonController.cs, around lines 268–272. No new imports or helpers are needed; we reuse the existing Url helper and routing.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

This pull request addresses a security vulnerability (code scanning alert #316) related to URL redirection from a remote source in the SetStore method. The fix implements a safer pattern by introducing a separate variable for the redirect URL that is initialized with a safe default value and only assigned user input after validation.

Key Changes

• Introduces a dedicated redirectUrl variable initialized with a safe default route
• Inverts the validation logic to assign the user-provided returnUrl only when it passes the IsLocalUrl check
• Ensures untrusted user input is never passed directly to the Redirect method

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.