@spfn/auth 0.3.0-beta.16 → 0.3.0-beta.17

package/dist/server.js

@@ -10641,6 +10641,9 @@ async function changePasswordService(params) {
 import { env as env9 } from "@spfn/auth/config";
 import { InvalidSignupLinkError, InvalidSignupSetupSessionError } from "@spfn/auth/errors";
 init_repositories();
+
+// src/lib/return-path.ts
+var URL_STRIPPED_CHARACTER = /[\t\n\r]/;
 function isSafeReturnPath(returnPath) {
   if (!returnPath.startsWith("/")) {
     return false;
@@ -10648,11 +10651,13 @@ function isSafeReturnPath(returnPath) {
   if (returnPath.startsWith("//") || returnPath.includes("\\")) {
     return false;
   }
-  if (returnPath.includes("..")) {
+  if (returnPath.includes("..") || URL_STRIPPED_CHARACTER.test(returnPath)) {
     return false;
   }
   return !/^\/[^/?#]*:/.test(returnPath);
 }
+
+// src/server/services/signup-link.service.ts
 async function requestSignupLinkService(params) {
   const email = params.email.trim();
   const returnPath = params.returnPath;
@@ -13070,7 +13075,11 @@ async function oauthCallbackService(params) {
   const redirectUrl = buildRedirectUrl(callbackUrl, {
     userId: String(userId),
     keyId: stateData.keyId,
-    returnUrl: stateData.returnUrl,
+    // Defence in depth: the state is sealed, so this value was already checked
+    // where it was sealed. Checking it again costs one comparison and keeps a
+    // destination that leaves the app out of the callback URL no matter which
+    // seam sealed it.
+    returnUrl: isSafeReturnPath(stateData.returnUrl) ? stateData.returnUrl : "/",
     isNewUser: String(isNewUser)
   });
   const user = await usersRepository.findById(userId);
@@ -16312,6 +16321,9 @@ var oauthStart = route6.post("/_auth/oauth/start").input({
   })
 }).use([rateLimitPolicy6("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
+  if (!isSafeReturnPath(body.returnUrl)) {
+    throw new ValidationError13({ message: "returnUrl must be a relative path within the app" });
+  }
   const nonce = generateOAuthNonce();
   setCookie(c.raw, COOKIE_NAMES.OAUTH_CSRF, nonce, {
     httpOnly: true,
@@ -16360,6 +16372,9 @@ var oauthFinalize = route6.post("/_auth/oauth/finalize").input({
   })
 }).use([rateLimitPolicy6("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
+  if (body.returnUrl && !isSafeReturnPath(body.returnUrl)) {
+    throw new ValidationError13({ message: "returnUrl must be a relative path within the app" });
+  }
   return {
     success: true,
     userId: body.userId,