[Vulnerability] Cross site scripting (XSS) and Open Redirect on the l…

…ogin page (#396)
ngoduykhanh · Jun 23, 2023 · 6bbe230 · 6bbe230
1 parent 28f3e82
commit 6bbe230
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/templates/login.html b/templates/login.html
@@ -84,7 +84,7 @@
     function redirectNext() {
         const urlParams = new URLSearchParams(window.location.search);
         const nextURL = urlParams.get('next');
-        if (nextURL) {
+        if (nextURL && /(?:^\/[a-zA-Z_])|(?:^\/$)/.test(nextURL.trim())) {
             window.location.href = nextURL;
         } else {
             window.location.href = '/{{.basePath}}';