fix(auth): retain protected deep-link state through sign-in

2026-10-10 14:32:24 +02:00
parent c37cab560a
commit 6843767176
6 changed files with 250 additions and 18 deletions
@@ -6,6 +6,28 @@ export const AUTH_USER_CHANGED_EVENT = "auth-user-changed";

 export type AuthPersistence = "local" | "session";

+export function safeAuthReturnPath(value: unknown): string | undefined {
+  if (typeof value !== "string" || !value.startsWith("/") || value.startsWith("//") || /[\u0000-\u001f\u007f\\]/.test(value)) return undefined;
+  try {
+    decodeURIComponent(value);
+    const target = new URL(value, window.location.origin);
+    let path = target.pathname;
+    // Validate decoded path meaning without changing encoded query/fragment navigation.
+    for (;;) {
+      const decoded = decodeURIComponent(path);
+      if (decoded === path) break;
+      path = decoded;
+    }
+    if (path.startsWith("//") || /[\u0000-\u001f\u007f\\]/.test(path)) return undefined;
+    const normalized = new URL(path, window.location.origin);
+    if (target.origin !== window.location.origin || normalized.origin !== window.location.origin
+      || ["/", "/login", "/register"].includes(normalized.pathname.replace(/\/+$/, "").toLowerCase() || "/")) return undefined;
+    return value;
+  } catch {
+    return undefined;
+  }
+}
+
 function safeGet(storage: Storage, key: string): string | null {
  try {
    return storage.getItem(key);