// http://code.google.com/p/html5security/wiki/RedirectionMethods
// <meta http-equiv="location" content="URL=http://evil.com" />
// <meta http-equiv="refresh" content="0;url=http://evil.com/" />
//
String content = msg.getResponseBody().toString();
Source htmlSrc = new Source(content);
List<Element> metaElements = htmlSrc.getAllElements(HTMLElementName.META);
for (Element el : metaElements) {
value = el.getAttributeValue("http-equiv");
if (value != null) {
if (value.equalsIgnoreCase("location")) {
// Get the content attribute value
value = el.getAttributeValue("content");
// Check if the payload is inside the location attribute
if (checkPayload(value, payload)) {
return REDIRECT_LOCATION_META;
}
} else if (value.equalsIgnoreCase("refresh")) {
// Get the content attribute value
value = el.getAttributeValue("content");
// If the content attribute isn't set go away
if (value != null) {
// Usually redirect content is configured with a delay
// so extract the url component
value = getRefreshUrl(value);
// Check if the payload is inside the location attribute
if (checkPayload(value, payload)) {
return REDIRECT_REFRESH_META;
}
}
}
}
}
// (4) Check if redirection occurs by Base Tag
// http://code.google.com/p/html5security/wiki/RedirectionMethods
// <base href="http://evil.com/" />
//
// (5) Check if redirection occurs by Javascript
// http://code.google.com/p/html5security/wiki/RedirectionMethods
// location='http://evil.com/';
// location.href='http://evil.com/';
// location.reload('http://evil.com/');
// location.replace('http://evil.com/');
// location.assign('http://evil.com/');
// window.open('http://evil.com/');
// window.navigate('http://evil.com/');
//
if (StringUtils.indexOfIgnoreCase(content, payload) != -1) {
List<Element> jsElements = htmlSrc.getAllElements(HTMLElementName.SCRIPT);
String matchingUrl = "(\\Q" + payload + "\\E|\\Qhttp://" + REDIRECT_SITE + "\\E)";
Pattern pattern;
for (Element el : jsElements) {
value = el.getContent().toString();