From 5bcfdbe066e8c899f3ecf3fdcdbacc2ecba7f02f Mon Sep 17 00:00:00 2001
From: SabreCat <sabe@habitica.com>
Date: Fri, 20 May 2022 14:29:15 -0500
Subject: [PATCH] fix(login): catch double-slash exploit

---
 website/client/src/components/auth/registerLoginReset.vue | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/website/client/src/components/auth/registerLoginReset.vue b/website/client/src/components/auth/registerLoginReset.vue
index 7ecb8505b5..60a08f3b70 100644
--- a/website/client/src/components/auth/registerLoginReset.vue
+++ b/website/client/src/components/auth/registerLoginReset.vue
@@ -757,8 +757,8 @@ export default {
     }, 500),
     sanitizeRedirect (redirect) {
       if (!redirect) return '/';
-      let sanitizedString = DOMPurify.sanitize(redirect);
-      if (sanitizedString.slice(0, 1) !== '/') sanitizedString = `/${sanitizedString}`;
+      let sanitizedString = DOMPurify.sanitize(redirect).replace(/\\|\/\/|\./g, '');
+      sanitizedString = `/${sanitizedString}`;
       return sanitizedString;
     },
     async register () {