fix(login): catch double-slash exploit

2022-05-20 14:29:15 -05:00
parent 980e35880f
commit 5bcfdbe066
1 changed files with 2 additions and 2 deletions
@@ -757,8 +757,8 @@ export default {
    }, 500),
    sanitizeRedirect (redirect) {
      if (!redirect) return '/';
-      let sanitizedString = DOMPurify.sanitize(redirect);
-      if (sanitizedString.slice(0, 1) !== '/') sanitizedString = `/${sanitizedString}`;
+      let sanitizedString = DOMPurify.sanitize(redirect).replace(/\\|\/\/|\./g, '');
+      sanitizedString = `/${sanitizedString}`;
      return sanitizedString;
    },
    async register () {