fix(web): reject protocol-relative auth callbacks

2026-08-09 20:43:27 -05:00
parent 0aef432052
commit 90cf286a09
2 changed files with 8 additions and 1 deletions
@@ -14,6 +14,11 @@ describe('resolveAuthCallbackURL', () => {
    null,
    'chat',
    '//evil.example',
+    '/..//evil.com',
+    '/..//evil.com/x',
+    '/./..//evil.com',
+    '/../..//evil.com',
+    '/foo/..//evil.com',
    '/\\evil.example',
    '/\n//evil.example',
    '/\r//evil.example',
@@ -12,7 +12,9 @@ export function resolveAuthCallbackURL(candidate: string | null, currentOrigin:
  try {
    const expectedOrigin = new URL(currentOrigin).origin;
    const resolved = new URL(candidate, expectedOrigin);
-    if (resolved.origin !== expectedOrigin) return DEFAULT_AUTH_CALLBACK_URL;
+    if (resolved.origin !== expectedOrigin || resolved.pathname.startsWith('//')) {
+      return DEFAULT_AUTH_CALLBACK_URL;
+    }

    return `${resolved.pathname}${resolved.search}${resolved.hash}`;
  } catch {