diff options
| author | grm <grm@eyesin.space> | 2026-09-18 13:48:02 +0300 |
|---|---|---|
| committer | grm <grm@eyesin.space> | 2026-09-18 13:48:02 +0300 |
| commit | d71a01f4fcc4bb5ca040889694c94a07e52fa50e (patch) | |
| tree | e3b48bb3fa6d40c8bae171fc48f51907de5fbf78 /internal/db/migrations/blog/git@git.eyesin.space: | |
| parent | 3eeaa6d9a33f9294ade64c8ff26144fba86a379e (diff) | |
| download | blogspace-d71a01f4fcc4bb5ca040889694c94a07e52fa50e.tar.gz blogspace-d71a01f4fcc4bb5ca040889694c94a07e52fa50e.tar.bz2 blogspace-d71a01f4fcc4bb5ca040889694c94a07e52fa50e.zip | |
Security: Reject backslashes in post-login redirect targets
safeNext only refused a second leading slash, but browsers treat
"/\evil.com" as "//evil.com", so ?next= was still an open redirect
after login. No path of ours contains a backslash, so any one is refused.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A
Diffstat (limited to 'internal/db/migrations/blog/git@git.eyesin.space:')
0 files changed, 0 insertions, 0 deletions