[
  {
    "id": "REDIR001",
    "pattern": "redirect_to\\s+params\\[|redirect_to\\s+\\w+\\s*\\|\\||http\\.Redirect\\s*\\([^)]*r\\.Header|Response\\.Redirect\\s*\\(\\s*\\w*[Uu]rl",
    "flags": "i",
    "category": "open_redirect",
    "description": "Open redirect (various frameworks)",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "medium"
  },
  {
    "id": "REDIR002",
    "pattern": "http\\.Redirect\\s*\\([^,]+,\\s*[^,]+,\\s*(?:returnURL|redirectTo|returnUrl|returnTo|referer|destination)",
    "flags": "i",
    "category": "open_redirect",
    "description": "Go open redirect: http.Redirect with user-controlled variable (returnURL etc.)",
    "language": [
      "go"
    ],
    "severity": "medium"
  },
  {
    "id": "REDIR003",
    "pattern": "r\\.URL\\.Query\\(\\)\\.Get\\s*\\(\\s*[\"']return",
    "flags": "i",
    "category": "open_redirect",
    "description": "Go open redirect: r.URL.Query() used as redirect target",
    "language": [
      "go"
    ],
    "severity": "medium"
  },
  {
    "id": "REDIR004",
    "pattern": "Redirect\\s*\\(\\s*(?:\\w*[Uu]rl|returnUrl)\\b",
    "flags": "",
    "category": "open_redirect",
    "description": "Open redirect",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "medium"
  },
  {
    "id": "REDIR005",
    "pattern": "context\\.Response\\.Redirect\\s*\\(\\s*(?:next|url|returnUrl|redirect)",
    "flags": "i",
    "category": "open_redirect",
    "description": "C# open redirect",
    "language": [
      "csharp"
    ],
    "severity": "medium"
  },
  {
    "id": "REDIR006",
    "pattern": "return Redirect\\s*\\(\\s*(?:returnUrl|destination|state|next)\\s*\\)",
    "flags": "i",
    "category": "open_redirect",
    "description": "C# open redirect",
    "language": [
      "csharp"
    ],
    "severity": "medium"
  },
  {
    "id": "REDIR007",
    "pattern": "redirect_to\\s+params\\[:\\w+\\]",
    "flags": "i",
    "category": "open_redirect",
    "description": "Ruby open redirect",
    "language": [
      "ruby"
    ],
    "severity": "medium"
  },
  {
    "id": "REDIR008",
    "pattern": "redirect_to\\s+(?:next_url|callback|destination|target)",
    "flags": "i",
    "category": "open_redirect",
    "description": "Ruby open redirect",
    "language": [
      "ruby"
    ],
    "severity": "medium"
  },
  {
    "id": "REDIR009",
    "pattern": "header\\s*\\(\\s*[\"']Location:[\"']\\s*\\.\\s*\\$(?:_GET|_POST|url|next|redirect)",
    "flags": "i",
    "category": "open_redirect",
    "description": "PHP open redirect: header Location",
    "language": [
      "php"
    ],
    "severity": "medium"
  },
  {
    "id": "REDIR010",
    "pattern": "header\\s*\\(\\s*[\"']Location:[\"']\\s*\\.\\s*\\$",
    "flags": "i",
    "category": "open_redirect",
    "description": "PHP open redirect: header Location",
    "language": [
      "php"
    ],
    "severity": "medium"
  },
  {
    "id": "REDIR011",
    "pattern": "header\\s*\\(\\s*['\"]Location:\\s*['\"]\\s*\\.\\s*\\$(?:url|next|redirect|return_to|target|to)\\b",
    "flags": "i",
    "category": "open_redirect",
    "description": "PHP open redirect: header('Location') with user-controlled variable",
    "language": [
      "php"
    ],
    "severity": "medium"
  },
  {
    "id": "REDIR012",
    "pattern": "header\\s*\\(\\s*['\"]Location:\\s*['\"]\\s*\\.\\s*\\$(?:_GET|_POST|_REQUEST)",
    "flags": "i",
    "category": "open_redirect",
    "description": "PHP open redirect: header('Location') with user-controlled variable",
    "language": [
      "php"
    ],
    "severity": "medium"
  },
  {
    "id": "REDIR013",
    "pattern": "header\\s*\\(\\s*\"Location:\\s*\\$(?:url|next|redirect|target|return)",
    "flags": "i",
    "category": "open_redirect",
    "description": "PHP open redirect: header('Location') with user-controlled variable",
    "language": [
      "php"
    ],
    "severity": "medium"
  },
  {
    "id": "REDIR014",
    "pattern": "header\\s*\\(\\s*\"Location:\\s*\"\\.\\s*\\$\\w",
    "flags": "i",
    "category": "open_redirect",
    "description": "PHP open redirect: header('Location') with user-controlled variable",
    "language": [
      "php"
    ],
    "severity": "medium"
  },
  {
    "id": "REDIR015",
    "pattern": "http\\.Redirect\\s*\\(\\s*w\\s*,\\s*r\\s*,\\s*(?:returnURL|returnUrl|destination|state|next|returnTo|referer)",
    "flags": "i",
    "category": "open_redirect",
    "description": "Go open redirect",
    "language": [
      "go"
    ],
    "severity": "medium"
  },
  {
    "id": "REDIR016",
    "pattern": "http\\.Redirect\\s*\\(\\s*w\\s*,\\s*r\\s*,\\s*(?:string\\()?\\s*(?:returnURL|returnUrl|destination|state|next|returnTo|referer)",
    "flags": "i",
    "category": "open_redirect",
    "description": "Go: timing attack via != comparison of tokens; open redirect via decoded state",
    "language": [
      "go"
    ],
    "severity": "medium"
  }
]