@absolutejs/auth 0.59.2 → 0.59.3

package/dist/redirect.d.ts

@@ -0,0 +1,2 @@
+export declare const isSafeLocalPath: (value: string) => boolean;
+export declare const toSafeLocalPath: (value: string | undefined, fallback?: string) => string;

package/dist/server.js

@@ -11271,6 +11271,12 @@ var resolveProviderClientConfiguration = ({
 // src/routes/authorize.ts
 init_constants();
 import { Elysia as Elysia27, t as t20 } from "elysia";
+
+// src/redirect.ts
+var isSafeLocalPath = (value) => /^\/(?![/\\])/.test(value);
+var toSafeLocalPath = (value, fallback = "/") => value !== undefined && isSafeLocalPath(value) ? value : fallback;
+
+// src/routes/authorize.ts
 var parseReferer = (headerReferer) => {
   if (!headerReferer)
     return "/";
@@ -11278,10 +11284,7 @@ var parseReferer = (headerReferer) => {
     const url = new URL(headerReferer);
     return url.pathname + url.search;
   } catch {
-    if (headerReferer.startsWith("/") && !headerReferer.startsWith("//")) {
-      return headerReferer;
-    }
-    return "/";
+    return toSafeLocalPath(headerReferer);
   }
 };
 var authorize = ({
@@ -12958,7 +12961,7 @@ var parseReferer2 = (referer) => {
     const url = new URL(referer);
     return url.pathname + url.search;
   } catch {
-    return referer.startsWith("/") && !referer.startsWith("//") ? referer : "/";
+    return toSafeLocalPath(referer);
   }
 };
 var oidcSsoRoutes = ({
@@ -13101,18 +13104,13 @@ var oidcSsoRoutes = ({
 
 // src/sso/samlRoutes.ts
 import { Elysia as Elysia39, t as t31 } from "elysia";
-var toLocalPath = (value) => {
-  if (value === undefined || value.length === 0)
-    return "/";
-  return value.startsWith("/") && !value.startsWith("//") ? value : "/";
-};
 var refererPath = (referer) => {
   if (referer === undefined)
     return "/";
   try {
-    return toLocalPath(new URL(referer).pathname);
+    return toSafeLocalPath(new URL(referer).pathname);
   } catch {
-    return toLocalPath(referer);
+    return toSafeLocalPath(referer);
   }
 };
 var settle = async (work) => {
@@ -13215,7 +13213,7 @@ var samlSsoRoutes = ({
         user,
         userSessionId
       });
-      return redirect(toLocalPath(body.RelayState));
+      return redirect(toSafeLocalPath(body.RelayState));
     } catch (error) {
       await onSsoCallbackError?.({ error, organizationId });
       return status("Internal Server Error", "SAML sign-in failed");
@@ -13306,7 +13304,7 @@ var samlSsoRoutes = ({
         sloUrl
       }) ?? Promise.resolve());
       if (!("error" in responseSettled)) {
-        return redirect(toLocalPath(RelayState));
+        return redirect(toSafeLocalPath(RelayState));
       }
       await onSsoCallbackError?.({
         error: responseSettled.error,
@@ -13354,7 +13352,7 @@ var samlSsoRoutes = ({
       });
       return redirect(url);
     }
-    return redirect(toLocalPath(info.relayState ?? RelayState));
+    return redirect(toSafeLocalPath(info.relayState ?? RelayState));
   }, {
     cookie: t31.Cookie({
       user_session_id: t31.Optional(userSessionIdTypebox)
@@ -38708,5 +38706,5 @@ export {
   VerificationProviderError
 };
 
-//# debugId=82A372899BEA4F4564756E2164756E21
+//# debugId=D7D259888A27730164756E2164756E21
 //# sourceMappingURL=server.js.map