public class

RedirectSanitiserImpl

extends Object
implements RedirectSanitiser
java.lang.Object
   ↳ com.atlassian.jira.web.action.RedirectSanitiserImpl

Summary

Public Constructors
RedirectSanitiserImpl(VelocityRequestContextFactory velocityRequestContextFactory)
Public Methods
boolean canRedirectTo(String redirectUri)
Returns a boolean indicating whether redirecting to the given URI is allowed or not.
@Nullable String makeSafeRedirectUrl(String redirectUrl)
Constructs a safe redirect URL out of user-provided input.
Protected Methods
String getCanonicalBaseURL()
Returns the canonical base URL for JIRA.
[Expand]
Inherited Methods
From class java.lang.Object
From interface com.atlassian.jira.web.action.RedirectSanitiser

Public Constructors

public RedirectSanitiserImpl (VelocityRequestContextFactory velocityRequestContextFactory)

Public Methods

public boolean canRedirectTo (String redirectUri)

Returns a boolean indicating whether redirecting to the given URI is allowed or not.

This method returns false if the redirectUri is an absolute URI and it points to a domain that is not this JIRA instance's domain, and true otherwise. If the uri is in the form //xxx then it is not allowed as per JRA-27405.

Parameters
redirectUri a String containing a URI
Returns
  • a boolean indicating whether redirecting to the given URI should be allowed or not

@Nullable public String makeSafeRedirectUrl (String redirectUrl)

Constructs a safe redirect URL out of user-provided input. This means checking that the URL has an HTTP or HTTPS scheme, and that it does not redirect to a different domain (i.e. not JIRA). If the redirectUrl does not meet these conditions, this method returns null.

This is used to prevent Open redirect attacks, which facilitate phishing attacks against JIRA users.

Parameters
redirectUrl a String containing the redirect URL
Returns
  • a safe redirect URL, or null

Protected Methods

protected String getCanonicalBaseURL ()

Returns the canonical base URL for JIRA.

Returns
  • a String containing the canonical base URL