updated: src/frontend/src/lib/utils.ts

updated:   src/frontend/src/routes/(needs_onboarding)/login/+page.svelte
updated:   src/frontend/src/routes/(needs_onboarding)/logout/+page.server.ts

Author: mhdgning131

src/frontend/src/lib/utils.ts

@@ -14,22 +14,18 @@ export type WithElementRef<T, U extends HTMLElement = HTMLElement> = T & { ref?:
 
 export function validateRedirectUrl(url: string, origin: string): string {
 	try {
-		const parsedUrl = new URL(url, origin);
-		if (parsedUrl.origin !== origin) {
-			const allowedDomains = ['chithi.dev', 'localhost'];
-			if (!allowedDomains.includes(parsedUrl.hostname) && !parsedUrl.hostname.endsWith('.chithi.dev')) {
-				url = '/';
-			}
-		}
-		if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {
-			url = '/';
+		const parsed = new URL(url, origin);
+
+		if (parsed.origin !== origin) {
+			throw new Error('External redirects are not allowed.');
 		}
-	} catch {
-		url = '/';
-	}
 
-	if (url.startsWith('/admin')) {
-		return '/';
+		if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+			throw new Error('Invalid protocol.');
+		}
+		return parsed.pathname + parsed.search + parsed.hash;
+	} catch (e) {
+		if (e instanceof Error) throw e;
+		throw new Error('Malformed redirect URL.');
 	}
-	return url;
 }

src/frontend/src/routes/(needs_onboarding)/login/+page.svelte

@@ -15,10 +15,17 @@
 	import AnimatedGrid from '$lib/components/AnimatedGrid.svelte';
 	import { validateRedirectUrl } from '$lib/utils';
 
-	// Next url
 	const nextUrl = $derived.by(() => {
-		const url = page.url.searchParams.get('next') ?? '/';
-		return validateRedirectUrl(url, page.url.origin);
+		const next = page.url.searchParams.get('next') ?? '/';
+		try {
+			const url = validateRedirectUrl(next, page.url.origin);
+			if (url.startsWith('/admin')) {
+				return '/';
+			}
+			return url;
+		} catch {
+			return '/';
+		}
 	});
 
 	let { data } = $props();

src/frontend/src/routes/(needs_onboarding)/logout/+page.server.ts

@@ -7,7 +7,15 @@ export const actions = {
 		await logout();
 
 		let next = url.searchParams.get('next') ?? '/';
-		next = validateRedirectUrl(next, url.origin);
+		try {
+			next = validateRedirectUrl(next, url.origin);
+		} catch {
+			next = '/';
+		}
+
+		if (next.startsWith('/admin')) {
+			next = '/';
+		}
 		throw redirect(303, next);
 	}
 };