23 lines
910 B
TypeScript
23 lines
910 B
TypeScript
/** Accept an application path, never an external URL or another auth handoff. */
|
|
export function safeAuthReturnPath(value: string | null | undefined): string | null {
|
|
if (!value || value.length > 2048 || !value.startsWith("/") || value.startsWith("//")) return null
|
|
if (/[\\\u0000-\u0020\u007f]/.test(value)) return null
|
|
try {
|
|
const url = new URL(value, "https://mmapp.invalid")
|
|
if (url.origin !== "https://mmapp.invalid" || /%/.test(url.pathname)) return null
|
|
if (/^\/(auth|api|access-denied)(\/|$)/.test(url.pathname)) return null
|
|
return url.pathname + url.search
|
|
} catch {
|
|
return null
|
|
}
|
|
}
|
|
|
|
export function permittedAuthReturnPath(
|
|
value: string | null | undefined,
|
|
allowed: (pathname: string) => boolean,
|
|
fallback: string,
|
|
): string {
|
|
const path = safeAuthReturnPath(value)
|
|
return path && allowed(new URL(path, "https://mmapp.invalid").pathname) ? path : fallback
|
|
}
|