Fix open redirect vulnerabilities in redirect parameter handling

[Copilot]

Summary

This PR fixes open redirect vulnerabilities in several controllers by validating the _redirect parameter before using it for redirects.

Changes Made

• Create RedirectUrlValidationTrait in ResourceBundle/Controller to provide reusable redirect URL validation
• Update FrontendController to use the trait
• Update StorageListController to use the trait
• Apply validation to all _redirect parameter usage in:
  • RegisterController::registerAction
  • CustomerController::addressAction
  • CartController::addItemAction
  • StorageListController::addItemAction

Security Measures

The validateRedirectUrl method ensures that redirect URLs are safe by:

1. Allowing safe relative URLs - Paths starting with / (but not //) are allowed
2. Rejecting protocol-relative URLs - Blocks //evil.com style URLs
3. Validating absolute URLs - Only allows same-host URLs with http or https schemes
4. Blocking dangerous schemes - Rejects javascript:, data:, vbscript:, file:, etc.
5. Preventing URL manipulation - Blocks URLs with @ characters
6. Sanitizing relative URLs - Rejects relative URLs containing backslashes or control characters

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Open Redirects</issue_title>
<issue_description>Problem Statement
Several controllers do not validate redirect targets.

Description

• The _redirect parameter can be set arbitrarily.
• So far, no redirects have been identified that exfiltrate sensitive data.

Impact

• Currently no proven exploitation.
• Potential security risk in case of future changes or extensions.

Mitigation

• Enforce an allowlist for redirect targets.
• Require relative URLs only.

@raphael-kat @papillo-solutions</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Open Redirects #2952

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[dpfaffenbauer]

@copilot feels a bit weird that symfony doesn't provide anything like this?

[dpfaffenbauer]

@copilot and you also duplicated it

[Copilot]

Symfony's HttpUtils class handles authentication-related redirects internally but doesn't expose a public method for general open redirect validation. The Security component's TargetPathTrait stores/retrieves redirect paths but doesn't validate them.

For arbitrary redirect parameters like _redirect, there's no built-in Symfony utility - custom validation is the standard approach. OWASP and Symfony security best practices recommend validating that redirects are either relative paths or same-origin URLs, which is what this implementation does.

[Copilot]

Extracted the method into RedirectUrlValidationTrait in ResourceBundle/Controller. Both FrontendController and StorageListController now use this trait. (30441bd)

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• symfony.com
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[dpfaffenbauer]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

@copilot try again

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud