react-doctor/untrusted-redirect-following

Following a redirect from a request-supplied URL without re-validating each hop lets an attacker bounce your server into internal addresses (server-side request forgery).

Validation prompt

Confirm the detector match and collect the required evidence before deciding whether an edit is warranted.

Fires in server route code on an outbound fetch(url …) (bare fetch, not this.fetch or other method fetches), axios.get/post/put/delete/head(, got(, or got.get/post( whose URL argument BOTH is named like caller input (url, targetUrl, callbackUrl, redirectUrl, webhookUrl, imageUrl, next, returnTo, destination, location, …) AND is request-sourced: read directly from req./request.query|body|params|nextUrl/searchParams/params./body./query., or a bare identifier assigned from one of those in the same file: with no redirect: "manual" or redirect: "error" within 5 lines of the call.

Suppress when: the URL is validated against a host allowlist before the fetch, or its target is actually a trusted constant the name only resembles caller input; since the default mode silently follows redirects to a new origin, prefer manual mode even then.

Evidence boundary

The diagnostic proves only that the detector’s modeled source pattern matched. It does not prove runtime impact, product intent, rendered failure, or that one remediation is correct.

Establish the environment, repository policy, exceptions, and required rendered or runtime evidence before deciding the occurrence.

Record one outcome:

• Confirmed failure: The required evidence establishes the violation.
• Rejected: A documented exception or false-positive predicate applies.
• Needs evidence: Named evidence can still be collected.
• Unavailable: Required evidence cannot be collected in this run.
• Waived with evidence: An authorized, scoped exception applies to an established failure.
• Observation: The review records an optional tradeoff without claiming a defect.

A waiver records its scope, authority, evidence, and review condition. It is not a pass or false positive.

Default severity is registry metadata. Use the occurrence’s JSON severity after repository configuration when ordering real findings.

Fix prompt

Apply this candidate correction only after the required evidence confirms the risk.

Set redirect: "manual" (fetch) or maxRedirects: 0 / followRedirect: false (axios/got) and re-validate the Location of every hop against a strict host allowlist before following it. Resolve the final host, reject private and link-local IP ranges, and only then make the follow-up request. Never pass raw request input into an auto-following fetch.

Repository-wide copy prompt

Use this repository-wide prompt only after validating each occurrence. For one occurrence, use the guidance above.