Java代码审计之URL重定向的问题解决

@GetMapping("/redirect")
public String redirect(@RequestParam("url") String url) {
    return "redirect:" + url;
}

@RequestMapping("/setHeader")
@ResponseBody
public static void setHeader(HttpServletRequest request, HttpServletResponse response) {
    String url = request.getParameter("url");
    response.setStatus(HttpServletResponse.SC_MOVED_PERMANENTLY); // 301 redirect
    response.setHeader("Location", url);
}

@RequestMapping("/sendRedirect")
@ResponseBody
public static void sendRedirect(HttpServletRequest request, HttpServletResponse response) throws IOException {
    String url = request.getParameter("url");
    response.sendRedirect(url); // 302 redirect
}

@RequestMapping("/forward")
@ResponseBody
public static void forward(HttpServletRequest request, HttpServletResponse response) {
    String url = request.getParameter("url");
    RequestDispatcher rd = request.getRequestDispatcher(url);
    try {
        rd.forward(request, response);
    } catch (Exception e) {
        e.printStackTrace();
    }
}

@RequestMapping("/sendRedirect/sec")
    @ResponseBody
    public void sendRedirect_seccode(HttpServletRequest request, HttpServletResponse response)
            throws IOException {
        String url = request.getParameter("url");
        if (SecurityUtil.checkURL(url) == null) {
            response.setStatus(HttpServletResponse.SC_FORBIDDEN);
            response.getWriter().write("url forbidden");
            return;
        }
        response.sendRedirect(url);
    }
}

/**
 * 同时支持一级域名和多级域名，相关配置在resources目录下url/url_safe_domain.xml文件。
 * 优先判断黑名单，如果满足黑名单return null。
 *
 * @param url the url need to check
 * @return Safe url returns original url; Illegal url returns null;
 */
public static String checkURL(String url) {
​
    if (null == url){
        return null;
    }
​
    ArrayList<String> safeDomains = WebConfig.getSafeDomains();
    ArrayList<String> blockDomains = WebConfig.getBlockDomains();
​
    try {
        String host = gethost(url);
​
        // 必须http/https
        if (!isHttp(url)) {
            return null;
        }
​
        // 如果满足黑名单返回null
        if (blockDomains.contains(host)){
            return null;
        }
        for(String blockDomain: blockDomains) {
            if(host.endsWith("." + blockDomain)) {
                return null;
            }
        }
​
        // 支持多级域名
        if (safeDomains.contains(host)){
            return url;
        }
​
        // 支持一级域名
        for(String safedomain: safeDomains) {
            if(host.endsWith("." + safedomain)) {
                return url;
            }
        }
        return null;
    } catch (NullPointerException e) {
        logger.error(e.toString());
        return null;
    }
}