Bohan Jiang 2317533da4 fix(auth): validate next= redirect target to prevent open redirect (#1309) ...

* refactor(auth): add sanitizeNextUrl helper in @multica/core/auth

Extracts a reusable helper that returns a post-login redirect URL only
when it's a safe single-slash relative path, and null otherwise. Rejects
absolute URLs, protocol-relative URLs, backslashes, and control
characters so call sites can safely pass the result to router.push().

Keeping the rule in a single helper (with direct unit tests) avoids
each consumer re-implementing the validation and drifting.

* fix(auth): validate next= redirect target to prevent open redirect

Closes #1116

Next.js router.push accepts absolute URLs, so a crafted
`/login?next=https://evil.example` would send the user off-origin
after a successful login. The Google OAuth callback has the same
vector via the `state=next:<url>` payload.

Sanitize both entry points through `sanitizeNextUrl` from
`@multica/core/auth` so only safe single-slash relative paths survive;
null results fall through to the existing workspace-list-based default
without any hard-coded path.

---------

Co-authored-by: JunghwanNA <70629228+shaun0927@users.noreply.github.com>

2026-04-18 13:24:01 +08:00

..

desktop

fix(desktop): use releaseType instead of publishingType in electron-builder publish config (#1268)

2026-04-17 17:47:57 +08:00

docs

feat(docs): mount docs site at /docs subpath via basePath + multi-zone (#1160)

2026-04-17 16:05:30 +08:00

web

fix(auth): validate next= redirect target to prevent open redirect (#1309)

2026-04-18 13:24:01 +08:00