19 lines
952 B
TypeScript
19 lines
952 B
TypeScript
/**
|
|
* Validates a caller-supplied return path (a `callbackUrl` query param,
|
|
* a booking-draft continuation target) is a safe, internal, relative
|
|
* path before it's ever used in a redirect — see the brief's "Accept
|
|
* only safe internal return paths. Prevent open redirects." Auth.js's
|
|
* own `signIn()`/`redirectTo` already restricts to same-origin
|
|
* internally, but this is checked explicitly rather than relied on
|
|
* implicitly, since it guards a value that reached this code from a URL
|
|
* query string, not from a trusted internal source.
|
|
*/
|
|
export function safeRedirectPath(path: string | null | undefined, fallback: string): string {
|
|
if (!path) return fallback;
|
|
// Must start with exactly one "/" — rejects "//evil.com" (protocol-relative),
|
|
// "https://evil.com", and "javascript:..." in one check.
|
|
if (!path.startsWith("/") || path.startsWith("//")) return fallback;
|
|
if (path.includes("://")) return fallback;
|
|
return path;
|
|
}
|