admin/n8n-enterprise-unlocked
1
0
Fork 0
mirror of https://github.com/Abdulazizzn/n8n-enterprise-unlocked.git synced 2025-12-18 02:21:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(editor): Stop nefarious redirects during sign in (#16034)

Browse Source
This commit is contained in:
Marc Littlemore
2025-06-05 08:31:55 +01:00
committed by GitHub
parent 02ed7b6631
commit 4865d1e360
2 changed files with 123 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
packages/frontend/editor-ui/src/views/SigninView.vue
View File

@@ -101,7 +101,19 @@ const onEmailPasswordSubmitted = async (form: EmailOrLdapLoginIdAndPassword) =>
const isRedirectSafe = () => {
const redirect = getRedirectQueryParameter();
return redirect.startsWith('/') || redirect.startsWith(window.location.origin);
// Allow local redirects
if (redirect.startsWith('/')) {
return true;
}
try {
// Only allow origin domain redirects
const url = new URL(redirect);
return url.origin === window.location.origin;
} catch {
return false;
}
};
const getRedirectQueryParameter = () => {