Security: Reject backslashes in post-login redirect targets

safeNext only refused a second leading slash, but browsers treat
"/\evil.com" as "//evil.com", so ?next= was still an open redirect
after login. No path of ours contains a backslash, so any one is refused.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A

1 files changed, 4 insertions, 2 deletions

diff --git a/internal/web/handlers_auth.go b/internal/web/handlers_auth.go
index 6c76d81..708285d 100644
--- a/internal/web/handlers_auth.go
+++ b/internal/web/handlers_auth.go
@@ -153,9 +153,11 @@ func (s *Server) handlePassword(w http.ResponseWriter, r *http.Request) {
 	redirectOK(w, r, "/dashboard", s.tr(r, "Password changed."))
 }
 
-// safeNext only allows local paths as post-login redirect targets.
+// safeNext only allows local paths as post-login redirect targets: one
+// leading slash, and no backslash anywhere — browsers read "/\evil.com" as
+// "//evil.com", and no path of ours has one.
 func safeNext(n string) string {
-	if strings.HasPrefix(n, "/") && !strings.HasPrefix(n, "//") {
+	if strings.HasPrefix(n, "/") && !strings.HasPrefix(n, "//") && !strings.Contains(n, `\`) {
 		return n
 	}
 	return ""