Harden auth and mobile session handling

2026-06-29 15:21:31 -04:00
parent d0c916d659
commit ef826dffa9
20 changed files with 403 additions and 106 deletions
@@ -0,0 +1,23 @@
+const FALLBACK_CALLBACK_PATH = "/dashboard";
+
+export function safeCallbackPath(value: string | null | undefined) {
+  if (!value) return FALLBACK_CALLBACK_PATH;
+
+  const trimmed = value.trim();
+  if (
+    !trimmed.startsWith("/") ||
+    trimmed.startsWith("//") ||
+    trimmed.includes("\\") ||
+    /[\u0000-\u001f\u007f]/.test(trimmed)
+  ) {
+    return FALLBACK_CALLBACK_PATH;
+  }
+
+  try {
+    const url = new URL(trimmed, "https://beenvoice.local");
+    if (url.origin !== "https://beenvoice.local") return FALLBACK_CALLBACK_PATH;
+    return `${url.pathname}${url.search}${url.hash}`;
+  } catch {
+    return FALLBACK_CALLBACK_PATH;
+  }
+}