Repository navigation
Conversation
The callbackUrl sanitizer checked the raw value for a leading '//', but dot segments normalize into a protocol-relative path after parsing, which the router reads as another host. The parsed pathname is now checked too. The locale-prefix 308 also collapses leading slashes, so it never emits a two-slash Location. Closes #1305 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
If your organization's extra usage balance is empty, an organization admin can add extra usage credits at claude.ai/admin-settings/usage. If its monthly spend limit was reached, an admin can raise it on the same page. If neither applies, contact Anthropic support.
Once extra usage is available, someone with write access to this repository can comment @claude review on this pull request to trigger a review.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 7 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![dos[bot]](https://avatars.githubusercontent.com/in/4711427?s=60&v=4){kind=small}
Closes #1305
From the apps/web security review. Severity: medium (phishing aid, no data exposure).
What
sanitizeAuthRedirectTarget(components/auth/RateAuthPortal.tsx): after parsing, a target whose pathname starts with//or contains a backslash goes to/. Dot segments could normalize a same-origin-looking value into a protocol-relative path, which the client router reads as another host.proxy.ts: the locale-prefix 308 collapses leading slashes, so it never emits a Location with two leading slashes (defence in depth; the Node server normalizes such paths first).Tests (
core-rate-architecture.test.ts)The normalizing forms go to
/; a normal relative path with..still resolves on the site;/en//...308s to a one-slash path.Review gate
Codex adversarial, 1 round: no bypass found (about 318,000 generated inputs: encodings, control characters, Unicode, dot segments, query and hash,
javascript:, long strings), and the locale Location outputs are as expected.Checks
Web
pnpm test,tsc --noEmit, eslint, prettier: green locally.🤖 Generated with Claude Code
📌 TL;DR
This PR hardens the application against Open Redirect vulnerabilities by sanitizing URL paths that normalize to protocol-relative targets (e.g.,
//evil.com) in both the auth redirect handler and the locale proxy middleware.🎯 Type of Change
🔍 Changes Walkthrough
apps/web/src/components/auth/RateAuthPortal.tsxsanitizeAuthRedirectTargetto reject paths starting with//or containing backslashes, preventing dot-segment normalization attacks (e.g.,/.//host) from bypassing origin checks.apps/web/src/proxy.tslocaleProxyto strip leading slashes from the path segment after the locale prefix, ensuring that inputs like/en//hostdo not result in a protocol-relative redirect.apps/web/src/server/rate/__tests__/core-rate-architecture.test.ts📊 Architectural Flow
flowchart TD A[Incoming Request] --> B{Is Auth Redirect?} B -->|Yes| C[sanitizeAuthRedirectTarget] C --> D{Origin Valid?} D -->|No| E[Return /] D -->|Yes| F{Path starts with // or contains \\?} F -->|Yes| E F -->|No| G[Return Sanitized Path] B -->|No| H{Has Locale Prefix?} H -->|Yes| I[Extract Path Segment] I --> J[Strip Leading Slashes] J --> K[Construct Safe Redirect URL] H -->|No| L[Pass Through]