thoughtsync

bvandeusen/thoughtsync

Fork 0

Files

T

History

bvandeusenandClaude Opus 4.8 9c679d0ab9

CI & Build / Python lint (push) Successful in 2s

Details

CI & Build / TypeScript typecheck (push) Successful in 6s

Details

CI & Build / Python tests (push) Successful in 8s

Details

CI & Build / Build & push image (push) Successful in 30s

Details

M9 S5: guard the login ?redirect= against open redirect

LoginView handed route.query.redirect straight to router.replace, so a
crafted link like /login?redirect=//evil.com (or a backslash variant) could
bounce a just-authenticated user off-site. safeRedirect() now only follows an
in-app absolute path — a single leading slash, rejecting "//host" and "/\\host"
(and anything without a leading slash, i.e. absolute/scheme URLs) → falls back
to "/". Frontend-only; CI vue-tsc is the gate.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm

2026-07-23 21:48:41 -04:00