mosaicstack/stack
1
0
Fork 1
Code Issues 207 Pull Requests 14 Actions Packages Projects Releases 15 Wiki Activity

fix(web): reject protocol-relative auth callbacks
ci/woodpecker/pr/ci Pipeline was successful
Details

Browse Source
This commit is contained in:
shaggy (mosaic-dev box)
2026-08-09 20:43:27 -05:00
parent 0aef432052
commit 90cf286a09
2 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/web/src/lib/auth-redirect.spec.ts
+5
View File
@@ -14,6 +14,11 @@ describe('resolveAuthCallbackURL', () => {
null, null,
'chat', 'chat',
'//evil.example', '//evil.example',
'/..//evil.com',
'/..//evil.com/x',
'/./..//evil.com',
'/../..//evil.com',
'/foo/..//evil.com',
'/\\evil.example', '/\\evil.example',
'/\n//evil.example', '/\n//evil.example',
'/\r//evil.example', '/\r//evil.example',
apps/web/src/lib/auth-redirect.ts
+3 -1
View File
@@ -12,7 +12,9 @@ export function resolveAuthCallbackURL(candidate: string | null, currentOrigin:
try { try {
const expectedOrigin = new URL(currentOrigin).origin; const expectedOrigin = new URL(currentOrigin).origin;
const resolved = new URL(candidate, expectedOrigin); const resolved = new URL(candidate, expectedOrigin);
if (resolved.origin !== expectedOrigin) return DEFAULT_AUTH_CALLBACK_URL; if (resolved.origin !== expectedOrigin || resolved.pathname.startsWith('//')) {
return DEFAULT_AUTH_CALLBACK_URL;
}
return `${resolved.pathname}${resolved.search}${resolved.hash}`; return `${resolved.pathname}${resolved.search}${resolved.hash}`;
} catch { } catch {