@spfn/auth 0.3.0-beta.15 → 0.3.0-beta.17

package/dist/server.js

@@ -10641,6 +10641,9 @@ async function changePasswordService(params) {
 import { env as env9 } from "@spfn/auth/config";
 import { InvalidSignupLinkError, InvalidSignupSetupSessionError } from "@spfn/auth/errors";
 init_repositories();
+
+// src/lib/return-path.ts
+var URL_STRIPPED_CHARACTER = /[\t\n\r]/;
 function isSafeReturnPath(returnPath) {
   if (!returnPath.startsWith("/")) {
     return false;
@@ -10648,11 +10651,13 @@ function isSafeReturnPath(returnPath) {
   if (returnPath.startsWith("//") || returnPath.includes("\\")) {
     return false;
   }
-  if (returnPath.includes("..")) {
+  if (returnPath.includes("..") || URL_STRIPPED_CHARACTER.test(returnPath)) {
     return false;
   }
   return !/^\/[^/?#]*:/.test(returnPath);
 }
+
+// src/server/services/signup-link.service.ts
 async function requestSignupLinkService(params) {
   const email = params.email.trim();
   const returnPath = params.returnPath;
@@ -13070,7 +13075,11 @@ async function oauthCallbackService(params) {
   const redirectUrl = buildRedirectUrl(callbackUrl, {
     userId: String(userId),
     keyId: stateData.keyId,
-    returnUrl: stateData.returnUrl,
+    // Defence in depth: the state is sealed, so this value was already checked
+    // where it was sealed. Checking it again costs one comparison and keeps a
+    // destination that leaves the app out of the callback URL no matter which
+    // seam sealed it.
+    returnUrl: isSafeReturnPath(stateData.returnUrl) ? stateData.returnUrl : "/",
     isNewUser: String(isNewUser)
   });
   const user = await usersRepository.findById(userId);
@@ -16032,7 +16041,7 @@ var userRouter = defineRouter3({
 // src/server/routes/oauth/index.ts
 init_esm();
 
-// ../../node_modules/.pnpm/hono@4.13.0/node_modules/hono/dist/utils/url.js
+// ../../node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/utils/url.js
 var tryDecode = (str, decoder) => {
   try {
     return decoder(str);
@@ -16049,7 +16058,7 @@ var tryDecode = (str, decoder) => {
 var tryDecodeURIComponent = (str) => str.indexOf("%") !== -1 ? tryDecode(str, decodeURIComponent_) : str;
 var decodeURIComponent_ = decodeURIComponent;
 
-// ../../node_modules/.pnpm/hono@4.13.0/node_modules/hono/dist/utils/cookie.js
+// ../../node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/utils/cookie.js
 var validCookieNameRegEx = /^[\w!#$%&'*.^`|~+-]+$/;
 var relaxedCookieNameRegEx = /^[!#-:<>-[\]-~]+$/;
 var validCookieValueRegEx = /^[ !#-:<-[\]-~]*$/;
@@ -16171,7 +16180,7 @@ var serialize = (name, value, opt) => {
   return _serialize(name, value, opt);
 };
 
-// ../../node_modules/.pnpm/hono@4.13.0/node_modules/hono/dist/helper/cookie/index.js
+// ../../node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/helper/cookie/index.js
 var getCookie = (c, key, prefix) => {
   const cookie = c.req.raw.headers.get("Cookie");
   if (typeof key === "string") {
@@ -16312,6 +16321,9 @@ var oauthStart = route6.post("/_auth/oauth/start").input({
   })
 }).use([rateLimitPolicy6("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
+  if (!isSafeReturnPath(body.returnUrl)) {
+    throw new ValidationError13({ message: "returnUrl must be a relative path within the app" });
+  }
   const nonce = generateOAuthNonce();
   setCookie(c.raw, COOKIE_NAMES.OAUTH_CSRF, nonce, {
     httpOnly: true,
@@ -16360,6 +16372,9 @@ var oauthFinalize = route6.post("/_auth/oauth/finalize").input({
   })
 }).use([rateLimitPolicy6("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
+  if (body.returnUrl && !isSafeReturnPath(body.returnUrl)) {
+    throw new ValidationError13({ message: "returnUrl must be a relative path within the app" });
+  }
   return {
     success: true,
     userId: body.userId,