Security: Reject backslashes in post-login redirect targets

safeNext only refused a second leading slash, but browsers treat
"/\evil.com" as "//evil.com", so ?next= was still an open redirect
after login. No path of ours contains a backslash, so any one is refused.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A

2 files changed, 15 insertions, 2 deletions

diff --git a/internal/web/handlers_auth.go b/internal/web/handlers_auth.go
index 6c76d81..708285d 100644
--- a/internal/web/handlers_auth.go
+++ b/internal/web/handlers_auth.go
@@ -153,9 +153,11 @@ func (s *Server) handlePassword(w http.ResponseWriter, r *http.Request) {
 	redirectOK(w, r, "/dashboard", s.tr(r, "Password changed."))
 }
 
-// safeNext only allows local paths as post-login redirect targets.
+// safeNext only allows local paths as post-login redirect targets: one
+// leading slash, and no backslash anywhere — browsers read "/\evil.com" as
+// "//evil.com", and no path of ours has one.
 func safeNext(n string) string {
-	if strings.HasPrefix(n, "/") && !strings.HasPrefix(n, "//") {
+	if strings.HasPrefix(n, "/") && !strings.HasPrefix(n, "//") && !strings.Contains(n, `\`) {
 		return n
 	}
 	return ""
diff --git a/internal/web/web_test.go b/internal/web/web_test.go
index 42d3b3a..7f66085 100644
--- a/internal/web/web_test.go
+++ b/internal/web/web_test.go
@@ -1003,3 +1003,14 @@ func TestHTTPSAndTrustProxy(t *testing.T) {
 		t.Errorf("clientIP without TRUST_PROXY = %q, want the peer", ip)
 	}
 }
+
+func TestSafeNext(t *testing.T) {
+	for in, want := range map[string]string{
+		"/b/alice/": "/b/alice/", "/dashboard?x=1": "/dashboard?x=1",
+		"//evil.com": "", `/\evil.com`: "", `/b/\x/`: "", "http://evil.com": "", "dashboard": "", "": "",
+	} {
+		if got := safeNext(in); got != want {
+			t.Errorf("safeNext(%q) = %q, want %q", in, got, want)
+		}
+	}
+}