Open Redirect in Echo Go with Cockroachdb

An Open Redirect in an Echo Go service that uses Cockroachdb typically arises when a handler accepts a user-supplied URL or path and performs an HTTP redirect without strict validation. If the handler queries Cockroachdb to determine redirect targets (for example, looking up a campaign code or a tenant-specific landing page), an attacker can supply a malicious URL that maps to a stored, attacker-controlled value in Cockroachdb, or exploit missing validation to redirect to any location.

Consider an Echo Go handler that reads a campaign_id from the request, queries Cockroachdb for a redirect URL, and then calls redirectContext. If the redirect URL is stored in Cockroachdb and an attacker can inject a malicious URL into that row, the handler will redirect any user to that attacker-controlled destination. Even without direct database injection, insufficient validation of the resolved URL allows open redirection:

// Vulnerable pattern: trusting a URL resolved from Cockroachdb
func redirectHandler(c echo.Context) error {
    campaignID := c.Param("campaign_id")
    var destURL string
    if err := db.QueryRow(context.Background(), "SELECT redirect_url FROM campaigns WHERE id = $1", campaignID).Scan(&destURL); err != nil {
        return c.String(http.StatusInternalServerError, "error")
    }
    // Missing validation of destURL; open redirect if destURL is attacker-controlled
    return redirectContext(c, destURL, http.StatusFound)
}

The risk is amplified when the redirect URL is built from multiple sources (e.g., a base from Cockroachdb combined with user input). An attacker who can influence database content (via other vectors or compromised admin workflows) can turn a legitimate lookup into an open redirect. Even without database write access, insufficient allowlisting of redirect targets enables abuse when combined with stored or reflected values from Cockroachdb rows.

In the context of a middleBrick scan, this vulnerability would appear under Authentication/Authorization and Input Validation checks, with findings tied to improper handling of redirects and external references resolved from Cockroachdb. The scanner does not change behavior but highlights where trust boundaries are violated.

Remediation focuses on strict allowlisting, canonicalization, and avoiding redirects to user-controlled destinations. When a lookup from Cockroachdb is necessary, treat the resolved URL as untrusted and validate it rigorously before any redirect.

1) Use an allowlist of trusted domains. Rather than storing arbitrary redirect URLs in Cockroachdb, store short tokens or campaign IDs that map to predefined, trusted base URLs. This prevents stored malicious values from causing open redirects:

// Safer pattern: map to a trusted base URL
const baseRedirect = "https://app.example.com/complete"
func redirectHandler(c echo.Context) error {
    campaignID := c.Param("campaign_id")
    var campaignName string
    if err := db.QueryRow(context.Background(), "SELECT name FROM campaigns WHERE id = $1", campaignID).Scan(&campaignName); err != nil {
        return c.String(http.StatusInternalServerError, "error")
    }
    // Only allow known campaign names; build a safe URL
    allowed := map[string]string{"summer_sale": "summer", "welcome": "welcome"}
    suffix, ok := allowed[campaignName]
    if !ok {
        return c.String(http.StatusBadRequest, "invalid campaign")
    }
    target := baseRedirect + "?ref=" + suffix
    return redirectContext(c, target, http.StatusFound)
}

2) Validate and canonicalize external URLs. If you must store external URLs in Cockroachdb, normalize them (e.g., via net/url) and ensure they use an allowed scheme and host. Reject relative URLs and URLs with non-HTTP(S) schemes:

import (
    "net/url"
    "strings"
)
func isValidRedirect(input string) bool {
    u, err := url.Parse(input)
    if err != nil || u.Scheme == "" || u.Host == "" {
        return false
    }
    // Allow only specific schemes
    if u.Scheme != "http" && u.Scheme != "https" {
        return false
    }
    // Optional: restrict to a set of allowed hosts
    allowedHosts := map[string]bool{"app.example.com": true, "static.example.com": true}
    if !allowedHosts[u.Host] {
        return false
    }
    // Reject URLs with fragments that could lead to open redirects via client-side routing
    return u.Fragment == ""
}
func redirectHandler(c echo.Context) error {
    campaignID := c.Param("campaign_id")
    var destURL string
    if err := db.QueryRow(context.Background(), "SELECT redirect_url FROM campaigns WHERE id = $1", campaignID).Scan(&destURL); err != nil {
        return c.String(http.StatusInternalServerError, "error")
    }
    if !isValidRedirect(destURL) {
        return c.String(http.StatusBadRequest, "invalid redirect target")
    }
    return redirectContext(c, destURL, http.StatusFound)
}

3) Avoid storing redirect URLs in Cockroachdb when possible. Prefer server-side mappings or signed tokens that reference internal routes. This removes the dependency on untrusted data from Cockroachdb for redirection decisions:

func redirectHandler(c echo.Context) error {
    token := c.Param("token")
    // Verify token signature and extract internal route identifier
    routeID, err := verifyToken(token)
    if err != nil {
        return c.String(http.StatusBadRequest, "invalid token")
    }
    // Map to an internal route; no external URL stored in Cockroachdb
    routes := map[string]string{"checkout": "/checkout", "profile": "/profile"}
    target, ok := routes[routeID]
    if !ok {
        return c.String(http.StatusBadRequest, "invalid route")
    }
    return redirectContext(c, target, http.StatusFound)
}

By combining Cockroachdb-stored identifiers with strict allowlists and avoiding raw external URLs for redirects, you mitigate open redirect risks while preserving legitimate navigation flows.