Ccodemod

codemod/express-req-url-redirect-allowlist

Transform Express.js route handlers that directly use req.url for redirects to include URL allowlist validation

securityexpressredirectallowlistvulnerability
Public
0 executions
Use dashboardApply to Repository

Run locally

npx codemod @codemod/express-req-url-redirect-allowlist

Express.js req.url Redirect Allowlist

A security-focused codemod that transforms Express.js route handlers using req.url in redirect calls to include URL allowlist validation, preventing open redirect vulnerabilities.

Security Context

This codemod addresses CWE-601: URL Redirection to Untrusted Site (Open Redirect), a critical security vulnerability where attackers can redirect users to malicious domains by crafting URLs that bypass basic validation.

References:

Installation

bash

What it does

This codemod detects dangerous patterns where Express.js applications use req.url directly in res.redirect() calls and wraps them with URL allowlist validation.

Before

javascript

After

javascript

Features

  • Detects vulnerable patterns: Finds direct usage of req.url in redirect calls
  • Variable tracking: Handles cases where req.url is assigned to variables first
  • Status code support: Works with both res.redirect(url) and res.redirect(status, url) patterns
  • Skip logic: Avoids transforming files that already have validation functions
  • Customizable allowlist: Provides a default allowlist that should be customized per application

Supported Patterns

✅ Transforms these patterns:

  • res.redirect(req.url)
  • res.redirect(301, req.url)
  • const url = req.url; res.redirect(url)
  • Arrow functions and function expressions
  • Router methods (router.get, router.post, etc.)
  • Middleware functions (app.use)

❌ Skips these patterns:

  • Static redirects like res.redirect('/static/path')
  • Query parameter redirects like res.redirect(req.query.returnUrl)
  • Files already containing isValidRedirectUrl function
  • Non-Express code patterns

Configuration

After running the codemod, you must customize the allowedDomains array for your specific application:

javascript

File Support

  • JavaScript (.js, .mjs)
  • TypeScript (.ts)
  • JSX/TSX (.jsx, .tsx)

Excludes:

  • Test files (*.test.*, *.spec.*, __tests__/)
  • Node modules
  • TypeScript declaration files (*.d.ts)

Development

bash

License

MIT

Contributing

When contributing, ensure:

  1. All tests pass (pnpm test)
  2. New test cases cover edge cases
  3. Security implications are considered
  4. Documentation is updated

Ready to contribute?

Build your own codemod and share it with the community.

Publish a codemodJoin the community