fix(auth): tighten sign-in "next" redirect to path-only targets

.github/workflows/ci.yml

@@ -19,6 +19,9 @@ jobs:
 
       - run: npm ci
 
+      - name: Unit tests
+        run: npm run test:unit
+
       - name: Typecheck and build
         run: npm run build
 

package.json

@@ -29,6 +29,7 @@
     "build": "node api.js && tsc -b && vite build",
     "preview": "vite preview",
     "test:smoke": "node scripts/smoke-test.mjs",
+    "test:unit": "node --test --experimental-strip-types src/lib/*.test.ts",
     "visual:check": "node scripts/visual-check.mjs",
     "typecheck": "tsc -b --pretty false"
   },

src/lib/redirect.test.ts

@@ -0,0 +1,41 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+import { safeRedirectTarget } from './redirect.ts';
+
+test('safeRedirectTarget accepts path-only targets', () => {
+  assert.equal(safeRedirectTarget('/issue/1'), '/issue/1');
+  assert.equal(safeRedirectTarget('/explore?focus=1'), '/explore?focus=1');
+});
+
+test('safeRedirectTarget rejects protocol-relative URLs', () => {
+  assert.equal(safeRedirectTarget('//example.com'), '/explore');
+  assert.equal(safeRedirectTarget('///example.com'), '/explore');
+});
+
+test('safeRedirectTarget rejects backslash-prefixed hosts', () => {
+  assert.equal(safeRedirectTarget('/\\example.com'), '/explore');
+  assert.equal(safeRedirectTarget('/\\\\example.com'), '/explore');
+});
+
+test('safeRedirectTarget rejects absolute URLs and schemes', () => {
+  assert.equal(safeRedirectTarget('https://example.com'), '/explore');
+  assert.equal(safeRedirectTarget('http://example.com/path'), '/explore');
+  assert.equal(safeRedirectTarget('javascript:alert(1)'), '/explore');
+});
+
+test('safeRedirectTarget rejects login targets to avoid redirect loops', () => {
+  assert.equal(safeRedirectTarget('/login'), '/explore');
+  assert.equal(safeRedirectTarget('/login?next=/issue/1'), '/explore');
+});
+
+test('safeRedirectTarget falls back for missing or empty values', () => {
+  assert.equal(safeRedirectTarget(null), '/explore');
+  assert.equal(safeRedirectTarget(undefined), '/explore');
+  assert.equal(safeRedirectTarget(''), '/explore');
+});
+
+test('safeRedirectTarget honours a custom fallback', () => {
+  assert.equal(safeRedirectTarget('//example.com', '/'), '/');
+  assert.equal(safeRedirectTarget(null, '/'), '/');
+});

src/lib/redirect.ts

@@ -0,0 +1,25 @@
+/**
+ * safeRedirectTarget validates a `next` redirect target coming from a sign-in
+ * URL before the app navigates to it.
+ *
+ * Only same-origin, path-only values are accepted: a single leading `/` not
+ * followed by `/` or `\`, and no scheme. Anything else falls back to the
+ * fallback destination, so the sign-in page cannot be used as an open
+ * redirect (`/login?next=//example.com`).
+ */
+export function safeRedirectTarget(next: string | null | undefined, fallback = '/explore'): string {
+  if (!next) return fallback;
+
+  // A path-only target must start with a single `/`.
+  if (next[0] !== '/') return fallback;
+
+  // `//example.com` is a protocol-relative URL and `/\example.com` is treated
+  // the same way by browsers that normalise backslashes in paths — both are
+  // cross-origin.
+  if (next[1] === '/' || next[1] === '\\') return fallback;
+
+  // Keep the login page from redirecting to itself.
+  if (next.startsWith('/login')) return fallback;
+
+  return next;
+}

src/pages/auth.tsx

@@ -5,6 +5,7 @@ import { ArrowRight, ShieldCheck } from 'lucide-react';
 import { useApp } from '../lib/store';
 import { Brand, EASE, Mark } from '../components/ui';
 import { PLATFORM } from '../lib/platform';
+import { safeRedirectTarget } from '../lib/redirect';
 
 function AuthFrame({
   kicker, title, sub, children, foot,
@@ -45,7 +46,7 @@ export function ContributorLogin() {
   const [params] = useSearchParams();
   const [name, setName] = useState(state.session.contributor ?? '');
   const next = params.get('next');
-  const dest = next && next.startsWith('/') && !next.startsWith('/login') ? next : '/explore';
+  const dest = safeRedirectTarget(next);
 
   const submit = (e: FormEvent) => {
     e.preventDefault();

tsconfig.app.json

@@ -11,12 +11,14 @@
     "forceConsistentCasingInFileNames": true,
     "module": "ESNext",
     "moduleResolution": "Bundler",
+    "allowImportingTsExtensions": true,
     "resolveJsonModule": true,
     "isolatedModules": true,
     "noEmit": true,
     "jsx": "react-jsx",
     "noUnusedLocals": true,
     "noUnusedParameters": true
   },
-  "include": ["src"]
+  "include": ["src"],
+  "exclude": ["src/**/*.test.ts"]
 }