php-open-redirect-audit

PHP Open Redirect Audit (php-open-redirect-audit)

Analyze whether all "jump/redirect" behaviors in the PHP project source code may have user-controlled destination addresses, leading to phishing or hijacking of flows such as OAuth.

Severity ratings and numbering

• See details:shared/SEVERITY_RATING.md
• Vulnerability ID:{C/H/M/L}-REDIR-{序号}

Required Sinks (mandatory)

Identify the following redirect output points:

• header("Location: {value}")
• <meta http-equiv="refresh" content="{value}">
• redirect() / to() / return redirect({value})
• Custom redirect functions (internally ultimately invoking Location output)

Controllability tracing (mandatory)

The following two types of variables must be traced:

1. Destination source: usually from $_GET['next']/$_POST['url']/Referer/return_to
2. Destination validation: whether only relative paths are allowed, whether there is an allowlist, whether schemes are rejected (http://///), whether the domain is validated

Bypass conditions (mandatory)

Potential bypasses must be identified and output:

• Scheme bypass://evil.com、http:%2f%2fevil.com
• Encoding bypass: double encoding, URL-encoded colon/slash
• Trailing/whitespace character bypass (common in older implementations)

Report output

{output_path}/vuln_audit/redir_{timestamp}.md

Entry template (mandatory)

Each vulnerability must include:

• Location evidence: redirect function location + route
• Data flow chain: user input -> validation -> header/redirect
• Exploitation preconditions: usually requires login (if redirect occurs after login) and whether the attacker can control the parameter
• Verification PoC (must be a real route; replace the destination parameter with the real field name)
• Remediation recommendation: only allow relative paths + server-side allowlist + normalize encoding/scheme before validation

Evidence citation (mandatory: from php-route-tracer)

Each suspected open redirect vulnerability must cite, item by item, the ## 9) Sink Evidence Type Checklist of REDIR lineCorresponding evidence points in the trace output (the status may be pending verification, but the evidence citation must exist):

1. EVID_REDIR_OUTPUT_POINT: Location evidence of the redirect output point (the final output location of header/redirect)
2. EVID_REDIR_DEST_SOURCE_MAPPING: Destination source variable mapping evidence (from route parameter to destination variable)
3. EVID_REDIR_DEST_VALIDATION_NORMALIZATION: Branch evidence for destination validation/normalization/allowlist/refuse scheme (including encoding bypass handling branches)

Handling of missing tracer evidence (mandatory)

• If any of the above key evidence points 1~3 cannot be located: the vulnerability status can only be marked as ⚠️待验证, and it must not be directly given as ✅已确认可利用。