# Unvalidated URL into redirect or embedded browser

Params, slugs or reserved keys reaching Location headers or embedded browser navigation without validation

_Area: Web injection and code execution. Seen in 3 disclosed reports; 2 confirmed bounties: $1,000 and $4,000; latest 2021-02-02. Updated 2026-10-24._

## How it works
A URL is built or navigated to from request-controlled input, and the code assumes that input is a harmless path or identifier. The assumption breaks because the sink honors more than the author expected: a redirect sink accepts absolute URLs, a URL builder honors framework-reserved keys, or an embedded browser loads whatever URL the handler assembles. The result is that the attacker, not the application, chooses the destination.

## Where it shows up
- Request params passed into a `Location` header or redirect helper without a relative-path check [E3](https://bugbountylibrary.com/r/h1%3A904059.md)
- Helpers that filter a few keys (host, port, protocol) before calling a URL builder, leaving other reserved keys controllable [E1](https://bugbountylibrary.com/r/h1%3A946728.md)
- Custom URI scheme handlers that take a path slug without validating its type or format [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-applying-offensive-reverse-engineering-to-facebook-gameroom.md)
- Any param that is JSON-decoded and merged into URL query params before navigation [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-applying-offensive-reverse-engineering-to-facebook-gameroom.md)
- Embedded browser (CefSharp/Chromium, Electron) navigation driven by client-supplied values [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-applying-offensive-reverse-engineering-to-facebook-gameroom.md)

## How to review
Trace every request-controlled value to its sink. The invariant: the final destination must be constrained to a relative path on the trusted origin, or to an allowlisted host, after all decoding and merging. For URL builders, diff the filtered keys against the framework's full reserved-options list; any unfiltered reserved key that rewrites the URL is a gap [E1](https://bugbountylibrary.com/r/h1%3A946728.md). For redirects, confirm the value is rejected if it is absolute or scheme-relative [E3](https://bugbountylibrary.com/r/h1%3A904059.md). For URI handlers, confirm the slug is validated against an expected format and that decoded params cannot inject query keys [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-applying-offensive-reverse-engineering-to-facebook-gameroom.md).

## Variants seen
- Reserved-key bypass: `domain`/`script_name` survive a partial filter and rewrite `url_for` output, giving open redirect and reflected XSS [E1](https://bugbountylibrary.com/r/h1%3A946728.md)
- Direct param-to-Location: middleware copies `location` into the header unchecked [E3](https://bugbountylibrary.com/r/h1%3A904059.md)
- Slug plus JSON param: unvalidated game ID and a decoded `canvas_params` dict let the attacker pick the URL loaded in the embedded browser [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-applying-offensive-reverse-engineering-to-facebook-gameroom.md)

## Why fixes fail
E3 shows a CVE patch that narrowed one condition while an adjacent unvalidated param in the same middleware stayed exposed; reviewers should diff the whole sink after a fix. E1 shows a denylist approach that missed reserved keys, so partial filtering is not a fix.

## Impact and severity
Open redirect enables phishing and token leakage; reflected XSS escalates to session compromise [E1](https://bugbountylibrary.com/r/h1%3A946728.md). Loading attacker-controlled content in an embedded outdated browser widens the attack surface toward client-side exploitation [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-applying-offensive-reverse-engineering-to-facebook-gameroom.md). Severity rises when the sink is reachable without interaction or when the embedded browser is outdated.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A946728.md
- E2: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-applying-offensive-reverse-engineering-to-facebook-gameroom.md
- E3: https://bugbountylibrary.com/r/h1%3A904059.md