@openmrs/esm-login-app 9.0.3-pre.4841 → 10.0.0

package/src/change-location-link/change-location-link.test.tsx

@@ -31,7 +31,7 @@ describe('ChangeLocationLink', () => {
     await user.click(changeLocationButton);
 
     expect(mockNavigate).toHaveBeenCalledWith({
-      to: '${openmrsSpaBase}/login/location?returnToUrl=/openmrs/spa/home&update=true',
+      to: '${openmrsSpaBase}/login/location?returnToUrl=%2Fopenmrs%2Fspa%2Fhome&update=true',
     });
   });
 });

package/src/location-picker/location-picker-view.component.tsx

@@ -16,6 +16,20 @@ import type { ConfigSchema } from '../config-schema';
 import type { LoginReferrer } from '../login/login.component';
 import styles from './location-picker.scss';
 
+/**
+ * Validates that a returnToUrl is safe to navigate to.
+ * Only same-origin URLs are permitted, preventing open-redirect attacks after login.
+ */
+export function isSafeReturnUrl(url: string): boolean {
+  if (!url) return false;
+  try {
+    const parsed = new URL(url, window.location.origin);
+    return parsed.origin === window.location.origin;
+  } catch {
+    return false;
+  }
+}
+
 interface LocationPickerProps {
   hideWelcomeMessage?: boolean;
   currentLocationUuid?: string;
@@ -70,11 +84,11 @@ const LocationPickerView: React.FC<LocationPickerProps> = ({ hideWelcomeMessage,
 
       updateDefaultLocation(locationUuid, saveUserPreference);
       sessionDefined.then(() => {
-        if (referrer && !['/', '/login', '/login/location'].includes(referrer)) {
+        if (referrer && referrer.startsWith('/') && !['/', '/login', '/login/location'].includes(referrer)) {
           navigate({ to: '${openmrsSpaBase}' + referrer });
           return;
         }
-        if (returnToUrl && returnToUrl !== '/') {
+        if (returnToUrl && isSafeReturnUrl(returnToUrl)) {
           navigate({ to: returnToUrl });
         } else {
           navigate({ to: config.links.loginSuccess });

package/src/location-picker/location-picker.test.tsx

@@ -3,6 +3,7 @@ import '@testing-library/jest-dom/vitest';
 import { screen, waitFor } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
 import {
+  navigate,
   openmrsFetch,
   setSessionLocation,
   setUserProperties,
@@ -21,7 +22,7 @@ import {
 } from '../../__mocks__/locations.mock';
 import { mockConfig } from '../../__mocks__/config.mock';
 import renderWithRouter from '../test-helpers/render-with-router';
-import LocationPickerView from './location-picker-view.component';
+import LocationPickerView, { isSafeReturnUrl } from './location-picker-view.component';
 
 const fistLocation = {
   uuid: 'uuid_1',
@@ -43,6 +44,7 @@ const mockSetSessionLocation = vi.mocked(setSessionLocation);
 const mockSetUserProperties = vi.mocked(setUserProperties);
 const mockUseConnectivity = vi.mocked(useConnectivity);
 const mockShowSnackbar = vi.mocked(showSnackbar);
+const mockNavigate = vi.mocked(navigate);
 
 describe('LocationPickerView', () => {
   beforeEach(() => {
@@ -344,3 +346,121 @@ describe('LocationPickerView', () => {
     });
   });
 });
+
+describe('isSafeReturnUrl', () => {
+  it('rejects an absolute external URL', () => {
+    expect(isSafeReturnUrl('https://evil.com/openmrs/spa/home')).toBe(false);
+  });
+
+  it('accepts an absolute same-origin SPA URL', () => {
+    const sameOriginSpaUrl = `${window.location.origin}/openmrs/spa/home`;
+    expect(isSafeReturnUrl(sameOriginSpaUrl)).toBe(true);
+  });
+
+  it('rejects a protocol-relative external URL', () => {
+    expect(isSafeReturnUrl('//evil.com/openmrs/spa/home')).toBe(false);
+  });
+
+  it('accepts a same-origin URL outside the SPA base', () => {
+    expect(isSafeReturnUrl('/openmrs/admin/index.htm')).toBe(true);
+  });
+
+  it('rejects a javascript: URL', () => {
+    expect(isSafeReturnUrl('javascript:alert(1)')).toBe(false);
+  });
+
+  it('rejects an empty string', () => {
+    expect(isSafeReturnUrl('')).toBe(false);
+  });
+
+  it('accepts a valid same-origin SPA path', () => {
+    expect(isSafeReturnUrl('/openmrs/spa/home')).toBe(true);
+  });
+
+  it('accepts a valid same-origin SPA sub-path', () => {
+    expect(isSafeReturnUrl('/openmrs/spa/patient/123/chart')).toBe(true);
+  });
+});
+
+describe('returnToUrl open-redirect protection', () => {
+  beforeEach(() => {
+    vi.mocked(useConnectivity).mockReturnValue(true);
+    vi.mocked(useConfig).mockReturnValue(mockConfig);
+
+    vi.mocked(useSession).mockReturnValue({
+      user: {
+        display: 'Testy McTesterface',
+        uuid: '90bd24b3-e700-46b0-a5ef-c85afdfededd',
+        userProperties: {},
+      } as LoggedInUser,
+    } as Session);
+
+    vi.mocked(openmrsFetch).mockResolvedValue(mockLoginLocations as FetchResponse<unknown>);
+    vi.mocked(setSessionLocation).mockResolvedValue(undefined);
+    mockNavigate.mockClear();
+  });
+
+  it('rejects an external returnToUrl and falls back to loginSuccess', async () => {
+    const user = userEvent.setup();
+
+    renderWithRouter(LocationPickerView, {}, { routes: ['?returnToUrl=https://evil.com/steal-creds'] });
+
+    const location = await screen.findByRole('radio', { name: fistLocation.name });
+    await user.click(location);
+
+    const submitButton = screen.getByRole('button', { name: /confirm/i });
+    await user.click(submitButton);
+
+    await waitFor(() => {
+      expect(mockSetSessionLocation).toHaveBeenCalledWith(fistLocation.uuid, expect.anything());
+    });
+
+    await waitFor(() => {
+      expect(mockNavigate).toHaveBeenCalledWith({ to: mockConfig.links.loginSuccess });
+    });
+
+    expect(mockNavigate).not.toHaveBeenCalledWith({ to: 'https://evil.com/steal-creds' });
+  });
+
+  it('rejects a protocol-relative returnToUrl and falls back to loginSuccess', async () => {
+    const user = userEvent.setup();
+
+    renderWithRouter(LocationPickerView, {}, { routes: ['?returnToUrl=//evil.com/openmrs/spa/home'] });
+
+    const location = await screen.findByRole('radio', { name: fistLocation.name });
+    await user.click(location);
+
+    const submitButton = screen.getByRole('button', { name: /confirm/i });
+    await user.click(submitButton);
+
+    await waitFor(() => {
+      expect(mockSetSessionLocation).toHaveBeenCalledWith(fistLocation.uuid, expect.anything());
+    });
+
+    await waitFor(() => {
+      expect(mockNavigate).toHaveBeenCalledWith({ to: mockConfig.links.loginSuccess });
+    });
+
+    expect(mockNavigate).not.toHaveBeenCalledWith({ to: '//evil.com/openmrs/spa/home' });
+  });
+
+  it('accepts a valid same-origin SPA returnToUrl', async () => {
+    const user = userEvent.setup();
+
+    renderWithRouter(LocationPickerView, {}, { routes: ['?returnToUrl=/openmrs/spa/home'] });
+
+    const location = await screen.findByRole('radio', { name: fistLocation.name });
+    await user.click(location);
+
+    const submitButton = screen.getByRole('button', { name: /confirm/i });
+    await user.click(submitButton);
+
+    await waitFor(() => {
+      expect(mockSetSessionLocation).toHaveBeenCalledWith(fistLocation.uuid, expect.anything());
+    });
+
+    await waitFor(() => {
+      expect(mockNavigate).toHaveBeenCalledWith({ to: '/openmrs/spa/home' });
+    });
+  });
+});

package/src/login/login.component.tsx

@@ -126,10 +126,10 @@ const Login: React.FC = () => {
           if (session.sessionLocation) {
             let to = loginLinks?.loginSuccess || '/home';
             if (location?.state?.referrer) {
+              // Only accept relative paths; absolute or protocol-relative referrers
+              // are silently ignored to prevent open-redirect attacks after login.
               if (location.state.referrer.startsWith('/')) {
                 to = `\${openmrsSpaBase}${location.state.referrer}`;
-              } else {
-                to = location.state.referrer;
               }
             }
 

package/vitest.config.ts

@@ -1,3 +1,4 @@
+import path from 'node:path';
 import { defineConfig } from 'vitest/config';
 
 export default defineConfig({
@@ -25,6 +26,7 @@ export default defineConfig({
     alias: {
       '@openmrs/esm-framework/src/internal': '@openmrs/esm-framework/mock',
       '@openmrs/esm-framework': '@openmrs/esm-framework/mock',
+      '@openmrs/esm-styleguide/src/internal': path.resolve(__dirname, '../../framework/esm-styleguide/src/internal.ts'),
     },
   },
 });