@robosystems/core 0.8.5 → 0.8.6

package/auth-core/sso.js

@@ -9,6 +9,28 @@ const debugLog = (message, error) => {
         console.debug(`[SSO] ${message}`, error);
     }
 };
+/**
+ * Reduce a `returnUrl` to a same-origin path, or reject it.
+ *
+ * The value reaches us from a query parameter (or the sessionStorage mirror of
+ * one), so it is attacker-controlled on any crafted SSO link: an absolute URL
+ * would bounce the freshly authenticated user to another site, and a
+ * `javascript:` payload would execute as this origin. Cross-app returns don't
+ * need the escape hatch — `getSSORedirectUrl` hands the path to the *target*
+ * app, which resolves it against its own origin — so a bare absolute path is
+ * the only shape we ever legitimately produce.
+ */
+const sanitizeReturnUrl = (returnUrl) => {
+    if (!returnUrl)
+        return null;
+    // `//host` and `/\host` are both protocol-relative once a browser
+    // normalises them, so a leading slash alone isn't enough.
+    if (!returnUrl.startsWith('/'))
+        return null;
+    if (returnUrl.startsWith('//') || returnUrl.startsWith('/\\'))
+        return null;
+    return returnUrl;
+};
 export class SSOManager {
     constructor(apiUrl) {
         this.authClient = new RoboSystemsAuthClient(apiUrl);
@@ -84,7 +106,7 @@ export class SSOManager {
             debugLog('sessionStorage read failed during SSO login', error);
         }
         const finalSessionId = sessionId; // Only use URL parameter for session ID
-        const finalReturnUrl = returnUrl || sessionStorageReturn;
+        const finalReturnUrl = sanitizeReturnUrl(returnUrl || sessionStorageReturn);
         if (!finalSessionId) {
             return null;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robosystems/core",
-  "version": "0.8.5",
+  "version": "0.8.6",
   "description": "Shared RoboSystems frontend core library (auth, contexts, task monitoring, UI components) for the RoboSystems Next.js apps",
   "license": "MIT",
   "private": false,