False Positive for Open Redirect

[chris-hanna]

Are cleansing functions taken into consideration by the analyzer? Not just for open redirect but also xss and other vulnerabilities that need sanitizing.

This still shows a warning:

//if (!string.IsNullOrEmpty(model.ReturnUrl))
if (Url.IsLocalUrl(model.ReturnUrl))
{
    return Redirect(model.ReturnUrl);
}

The only way to get rid of the warning is to hard code the url string which isn't practical...
return Redirect("www.google.com");

[JarLob]

While it should detect it automatically, the other workaround would be to add inline suppression.

[JarLob]

Closed via a1a2e92