From 093a725adb9ecca72ed79e03bbe0ac9a85398c0f Mon Sep 17 00:00:00 2001
From: Niels de Blaauw <niels@level-level.com>
Date: Thu, 31 Oct 2019 14:05:22 +0100
Subject: [PATCH] Adds WP.Security.SafeRedirect documentation.

---
 .../Docs/Security/SafeRedirectStandard.xml    | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 WordPress/Docs/Security/SafeRedirectStandard.xml

diff --git a/WordPress/Docs/Security/SafeRedirectStandard.xml b/WordPress/Docs/Security/SafeRedirectStandard.xml
new file mode 100644
index 0000000000..c2bcf5b8b7
--- /dev/null
+++ b/WordPress/Docs/Security/SafeRedirectStandard.xml
@@ -0,0 +1,19 @@
+<documentation title="Safe Redirect">
+    <standard>
+    <![CDATA[
+    wp_safe_redirect() should be used whenever possible to prevent open redirect vulnerabilities. One of the main uses of an open redirect vulnerability is to make phishing attacks more credible. In this case the user sees your (trusted) domain and might get redirected to an attacker controlled website aimed at stealing private information.
+    ]]>
+    </standard>
+    <code_comparison>
+        <code title="Valid: Redirect can only go to allowed domains.">
+        <![CDATA[
+<em>wp_safe_redirect</em>( $location );
+        ]]>
+        </code>
+        <code title="Invalid: Unsafe redirect, can be abused.">
+        <![CDATA[
+<em>wp_redirect</em>( $location );
+        ]]>
+        </code>
+    </code_comparison>
+</documentation>