legacy-knowledge-base
公開されました Sep. 10, 2025

/html/common/referer_jsp.jsp の脆弱性

written-by

Mariano Alvaro

How To articles are not official guidelines or officially supported documentation. They are community-contributed content and may not always reflect the latest updates to Liferay DXP. We welcome your feedback to improve How To articles!

While we make every effort to ensure this Knowledge Base is accurate, it may not always reflect the most recent updates or official guidelines.We appreciate your understanding and encourage you to reach out with any feedback or concerns.

legacy-article

learn-legacy-article-disclaimer-text

問題

  • /html/common/referer_jsp.jsp 悪意のあるリダイレクトに対して脆弱です。

Environment

  • /html/common/referer_jsp.jsp?referer=https://google.es またはその他のリダイレクトは、悪意のあるリダイレクトにつながる可能性があるため、通常、監査評価で共通の懸念事項として表示されます。

解決策

  • この脆弱性を軽減するには、必要なリダイレクトのみを許可するように次のプロパティを調整する必要があります。

    ##
    ## Redirect
    ##

    #
    # Set this property to "ip" or "domain" for the redirect security method. If
    # set to "domain", the portal will only redirect users to domains listed in
    # the property "redirect.url.domain.allowed". If set to "ip", the portal
    # will only redirect to domains whose IP address resolve to an IP address
    # listed in the property "redirect.url.ip.allowed".
    #
    # Env: LIFERAY_REDIRECT_PERIOD_URL_PERIOD_SECURITY_PERIOD_MODE
    #
    #redirect.url.security.mode=domain
    redirect.url.security.mode=ip

    #
    # Input a list of comma delimited domains which the portal is allowed to
    # redirect to. Input a blank list to allow any domain. Specifying a domain
    # with a leading "*." allows redirects to subdomains.
    #
    # Env: LIFERAY_REDIRECT_PERIOD_URL_PERIOD_DOMAINS_PERIOD_ALLOWED
    #
    redirect.url.domains.allowed=

    #
    # Input a list of comma delimited IPs which the portal is allowed to
    # redirect to. Input a blank list to allow any IP. SERVER_IP will be
    # replaced with the IP of the host server.
    #
    # Env: LIFERAY_REDIRECT_PERIOD_URL_PERIOD_IPS_PERIOD_ALLOWED
    #
    redirect.url.ips.allowed=\
    127.0.0.1,\
    SERVER_IP

追加情報

did-this-article-resolve-your-issue

legacy-knowledge-base