Fix open redirect on website, being used in phishing campaigns

[cgite]

Is your feature request related to a problem? Please describe

The URL https://analytics.betaflight.com/redir?dest= is actively being used in phishing campaigns.

Describe the solution you'd like

Remove open redirect

Describe alternatives you've considered

Blocking domain

Other information

No response

[nerdCopter]

@VitroidFPV @freasy ?

[freasy]

@cgite can you show me examples?

@blckmn

[nerdCopter]

jsut my useless 2 cents...

• maybe a node_module is the source, as grepping redirect shows many results.
• mitigation might include disabling redirects or whitelisting target domain (betaflight.com only)
• seemingly mitigation is a feature of the server. unsure if using apache httpd, asp.net or another. (check if url is local, allow redirect, else redirect home)

maybe a useful search result... too many vague docs out there.

• https://my-elliot.medium.com/what-is-the-open-redirect-vulnerability-find-it-and-protect-against-it-e525b607dc8c

[blckmn]

This has now been resolved.

https://analytics.betaflight.com/redir?dest=https://google.com&tag=empty

Now returns a 401.