Fix code scanning alert no. 235: URL redirection from remote source

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
grandnode · Oct 3, 2024 · ef1a1a2 · ef1a1a2
1 parent 945fdf8
commit ef1a1a2
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/src/Web/Grand.Web/Controllers/CommonController.cs b/src/Web/Grand.Web/Controllers/CommonController.cs
@@ -316,7 +316,8 @@ public virtual async Task<IActionResult> SetStoreTheme(
         [FromServices] StoreInformationSettings storeInformationSettings,
         [FromServices] IThemeContextFactory themeContextFactory, string themeName, string returnUrl = "")
     {
-        if (!storeInformationSettings.AllowCustomerToSelectTheme) return Redirect(returnUrl);
+        var validUrls = new List<string> { Url.RouteUrl("HomePage"), Url.RouteUrl("AnotherPage") }; // Add other valid URLs here
+        if (!storeInformationSettings.AllowCustomerToSelectTheme) return Redirect(validUrls.Contains(returnUrl) ? returnUrl : Url.RouteUrl("HomePage"));
 
         var themeContext = themeContextFactory.GetThemeContext("");
         if (themeContext != null) await themeContext.SetTheme(themeName);
@@ -325,7 +326,7 @@ public virtual async Task<IActionResult> SetStoreTheme(
         await _mediator.Publish(new ChangeThemeEvent(_workContext.CurrentCustomer, themeName));
 
         //home page
-        if (string.IsNullOrEmpty(returnUrl))
+        if (string.IsNullOrEmpty(returnUrl) || !validUrls.Contains(returnUrl))
             returnUrl = Url.RouteUrl("HomePage");
 
         //prevent open redirection attack