Phase 8

src/lib/utils/safe-redirect.ts

@@ -0,0 +1,18 @@
+/**
+ * Validates a caller-supplied return path (a `callbackUrl` query param,
+ * a booking-draft continuation target) is a safe, internal, relative
+ * path before it's ever used in a redirect — see the brief's "Accept
+ * only safe internal return paths. Prevent open redirects." Auth.js's
+ * own `signIn()`/`redirectTo` already restricts to same-origin
+ * internally, but this is checked explicitly rather than relied on
+ * implicitly, since it guards a value that reached this code from a URL
+ * query string, not from a trusted internal source.
+ */
+export function safeRedirectPath(path: string | null | undefined, fallback: string): string {
+  if (!path) return fallback;
+  // Must start with exactly one "/" — rejects "//evil.com" (protocol-relative),
+  // "https://evil.com", and "javascript:..." in one check.
+  if (!path.startsWith("/") || path.startsWith("//")) return fallback;
+  if (path.includes("://")) return fallback;
+  return path;
+}