Looking into options for externally facing Unity Forms that would trigger Workflow to generate email notifications. Pentesters have raised concerns that this type of form triggering workflow could be vulnerable to unvalidated redirects and forwards (by intercepting the submission in a proxy tool, e.g., Burpsuite Professional, inserting a domain url controlled by an attacker, and forwarding on the submission). Consumers of downstream notifications could then be presented with the malicious url.
Has this concern come up for anyone else? Any mitigation strategies?
