redirect_prescan report — 5 file(s), 18 finding(s)

HIGH   OR-REQ-URL         go/web.go:7  request-controlled redirect target — open redirect (phishing / oauth-code theft)
       | http.Redirect(w, r, r.URL.Query().Get("next"), 302)
HIGH   HDR-REQ-HEADER     go/web.go:12  request-controlled value in response-header set — CRLF splitting / header forgery
       | w.Header().Set("X-Next", r.URL.Query().Get("n"))
HIGH   OR-REQ-URL         java/Web.java:7  request-controlled redirect target — open redirect (phishing / oauth-code theft)
       | response.sendRedirect(request.getParameter("next"));
HIGH   OR-REQ-URL         java/Web.java:12  request-controlled redirect target — open redirect (phishing / oauth-code theft)
       | return "redirect:" + request.getParameter("path");
HIGH   OR-REQ-URL         js/routes.js:7  request-controlled redirect target — open redirect (phishing / oauth-code theft)
       | res.redirect(req.query.next);
HIGH   OR-REQ-URL         js/routes.js:12  request-controlled redirect target — open redirect (phishing / oauth-code theft)
       | res.redirect(302, req.query.u);
HIGH   HDR-REQ-HEADER     js/routes.js:17  request-controlled value in response-header set — CRLF splitting / header forgery
       | res.setHeader('X-Ref', req.query.r);
HIGH   OR-REQ-URL         js/routes.js:28  request-controlled value in a 3xx/Location write
       | res.writeHead(302, { 'Location': req.query.dest });
HIGH   DOM-OPEN-REDIRECT  js/routes.js:33  client-side location assignment fed from URL/search params — DOM open redirect
       | location.href = new URLSearchParams(location.search).get('next');
HIGH   OR-REQ-URL         php/web.php:3  request-controlled Location header — open redirect
       | header('Location: ' . $_GET['u']);
HIGH   HDR-REQ-HEADER     php/web.php:6  request-controlled value inside header() — response splitting / header forgery
       | header($_GET['h']);
HIGH   OR-REQ-URL         php/web.php:9  request-controlled redirect target — open redirect (phishing / oauth-code theft)
       | wp_redirect($_REQUEST['next']);
HIGH   OR-REQ-URL         php/web.php:12  request-controlled redirect target — open redirect (phishing / oauth-code theft)
       | function jump() { return redirect()->to(request()->input('u')); }
HIGH   OR-REQ-URL         py/views.py:8  request-controlled redirect target — open redirect (phishing / oauth-code theft)
       | return redirect(request.GET['next'])
HIGH   OR-REQ-URL         py/views.py:13  request-controlled redirect target — open redirect (phishing / oauth-code theft)
       | return RedirectResponse(url=request.query_params['n'])
MEDIUM HOST-HEADER-TRUST  js/routes.js:22  Host/X-Forwarded-Host used in URL construction — host-header poisoning (reset links, canonical URLs)
       | const link = 'https://' + req.headers.host + '/reset?tok=' + tok;
MEDIUM HOST-HEADER-TRUST  py/views.py:18  Host/X-Forwarded-Host used in URL construction — host-header poisoning (reset links, canonical URLs)
       | base = f"https://{request.headers['host']}/reset"
LOW    OR-REQ-URL         js/routes.js:41  request-controlled redirect target — open redirect (phishing / oauth-code theft)
       | res.redirect(isInternal(req.query.next) ? req.query.next : '/');

scope: deterministic pre-scan — flags patterns for review; not an audit, clean != redirect-safe