Closed fnimick closed 1 year ago
Good catch; would you like to send a PR?
PR raised here: https://github.com/graphile/starter/pull/321
This isn't actually resolved, at least in my testing - navigating to https://graphile-starter.herokuapp.com/login?next=%2F%2Fgoogle.com still redirects to Google post-login. I think this is happening client side in the post-login routing code.
Summary
isSafe
function in login does not correctly detect protocol-relative URLs and may redirect to third-party sites.Steps to reproduce
Login at https://graphile-starter.herokuapp.com/login?next=%2F%2Fgoogle.com and observe that you are redirect to Google post-login.
Expected results
Invalid third-party site URL in query param should be ignored.
Actual results
User is redirected to third-party site.