@caffeinebounce/identity 0.12.1 → 0.12.3

package/dist/server.mjs

@@ -1,6 +1,43 @@
 import { NextResponse } from 'next/server';
 export { generateSecureToken, getClientIP, getGeolocationFromIP, hashString } from '@caffeinebounce/shared-utils';
 
+// src/handlers/callback.ts
+
+// src/utils/redirect.ts
+var INTERNAL_REDIRECT_BASE = new URL("https://identity.invalid");
+var ENCODED_PATH_SEPARATOR = /%(?:2f|5c)/i;
+function hasControlCharacter(value) {
+  return Array.from(value).some((character) => {
+    const code = character.charCodeAt(0);
+    return code <= 31 || code === 127;
+  });
+}
+function isStrictInternalRedirect(candidate) {
+  if (!candidate?.startsWith("/") || hasControlCharacter(candidate)) {
+    return false;
+  }
+  const pathEnd = candidate.search(/[?#]/);
+  const pathname = pathEnd === -1 ? candidate : candidate.slice(0, pathEnd);
+  if (pathname.includes("\\") || ENCODED_PATH_SEPARATOR.test(pathname)) {
+    return false;
+  }
+  try {
+    const target = new URL(candidate, INTERNAL_REDIRECT_BASE);
+    return target.origin === INTERNAL_REDIRECT_BASE.origin;
+  } catch {
+    return false;
+  }
+}
+function getSafeInternalRedirect(candidate, fallback) {
+  if (isStrictInternalRedirect(candidate)) {
+    return candidate;
+  }
+  if (fallback === null) {
+    return null;
+  }
+  return isStrictInternalRedirect(fallback) ? fallback : "/";
+}
+
 // src/handlers/callback.ts
 var POST_AUTH_HOOK_ERROR_MESSAGE = "Authentication completed, but setup failed. Please try again.";
 var DEFAULT_LINKING_ACCOUNT_ERROR_MESSAGE = "This account is already connected to another account. Each external account can only be linked to one account.";
@@ -12,12 +49,6 @@ var EMAIL_OTP_TYPES = [
   "email_change",
   "email"
 ];
-function getSafeRedirectPath(candidate, fallback) {
-  if (candidate?.startsWith("/") && !candidate.startsWith("//")) {
-    return candidate;
-  }
-  return fallback;
-}
 function getEmailOtpType(value) {
   if (!value) {
     return null;
@@ -108,8 +139,9 @@ function createRedirectResponse(target, origin) {
   if (target instanceof URL) {
     return NextResponse.redirect(target.toString());
   }
-  if (target.startsWith("/") && !target.startsWith("//")) {
-    return NextResponse.redirect(`${origin}${target}`);
+  const safeTarget = getSafeInternalRedirect(target, null);
+  if (safeTarget) {
+    return NextResponse.redirect(`${origin}${safeTarget}`);
   }
   return null;
 }
@@ -171,15 +203,20 @@ function createAuthCallbackHandler({
   isLinkingFlow = isDefaultLinkingFlow,
   resolveLinkingErrorMessage
 }) {
+  const safeDefaultRedirect = getSafeInternalRedirect(
+    defaultRedirect,
+    "/dashboard"
+  );
+  const safeSignInPath = getSafeInternalRedirect(signInPath, "/signin");
   return async function GET(request) {
     const requestUrl = new URL(request.url);
     const code = requestUrl.searchParams.get("code");
     const tokenHash = requestUrl.searchParams.get("token_hash");
     const rawOtpType = requestUrl.searchParams.get("type");
     const otpType = getEmailOtpType(rawOtpType);
-    const next = getSafeRedirectPath(
+    const next = getSafeInternalRedirect(
       requestUrl.searchParams.get("next") ?? requestUrl.searchParams.get("redirect_to"),
-      defaultRedirect
+      safeDefaultRedirect
     );
     const origin = requestUrl.origin;
     const error = requestUrl.searchParams.get("error");
@@ -201,7 +238,7 @@ function createAuthCallbackHandler({
         return linkingErrorRedirect;
       }
       return NextResponse.redirect(
-        `${origin}${signInPath}?error=${encodeURIComponent(message)}`
+        `${origin}${safeSignInPath}?error=${encodeURIComponent(message)}`
       );
     }
     if (code) {
@@ -216,7 +253,7 @@ function createAuthCallbackHandler({
           flow: "oauth",
           postAuthHook,
           postAuthHookErrorMode,
-          signInPath,
+          signInPath: safeSignInPath,
           resolveSuccessRedirect
         });
       }
@@ -236,13 +273,13 @@ function createAuthCallbackHandler({
         return linkingErrorRedirect;
       }
       return NextResponse.redirect(
-        `${origin}${signInPath}?error=${encodeURIComponent(errorMessage)}`
+        `${origin}${safeSignInPath}?error=${encodeURIComponent(errorMessage)}`
       );
     }
     if (tokenHash || rawOtpType) {
       if (!tokenHash || !otpType) {
         return NextResponse.redirect(
-          `${origin}${signInPath}?error=${encodeURIComponent("Invalid verification link")}`
+          `${origin}${safeSignInPath}?error=${encodeURIComponent("Invalid verification link")}`
         );
       }
       const supabase = await createClient();
@@ -260,16 +297,16 @@ function createAuthCallbackHandler({
           otpType,
           postAuthHook,
           postAuthHookErrorMode,
-          signInPath,
+          signInPath: safeSignInPath,
           resolveSuccessRedirect
         });
       }
       return NextResponse.redirect(
-        `${origin}${signInPath}?error=${encodeURIComponent(verifyError.message)}`
+        `${origin}${safeSignInPath}?error=${encodeURIComponent(verifyError.message)}`
       );
     }
     return NextResponse.redirect(
-      `${origin}${signInPath}?error=No authorization code received`
+      `${origin}${safeSignInPath}?error=No authorization code received`
     );
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@caffeinebounce/identity",
-  "version": "0.12.1",
+  "version": "0.12.3",
   "description": "Authentication components and handlers for Caffeine Bounce projects",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -61,7 +61,7 @@
   "dependencies": {
     "@caffeinebounce/logger": "^0.10.0",
     "@caffeinebounce/shared-utils": "^0.7.136",
-    "@caffeinebounce/ui": "^0.62.2",
+    "@caffeinebounce/ui": "^0.62.3",
     "@supabase/ssr": "^0.8.0",
     "@supabase/supabase-js": "^2.49.4",
     "input-otp": "^1.4.2",