Merge branch 'sabrecat/sanitize-redirect' into release

website/client/package-lock.json

@@ -16940,6 +16940,11 @@
         "domelementtype": "1"
       }
     },
+    "dompurify": {
+      "version": "2.3.8",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-2.3.8.tgz",
+      "integrity": "sha512-eVhaWoVibIzqdGYjwsBWodIQIaXFSB+cKDf4cfxLMsK0xiud6SE+/WCVx/Xw/UwQsa4cS3T2eITcdtmTg2UKcw=="
+    },
     "domutils": {
       "version": "1.7.0",
       "resolved": "https://registry.npmjs.org/domutils/-/domutils-1.7.0.tgz",

website/client/package.json

@@ -33,6 +33,7 @@
     "bootstrap-vue": "^2.22.0",
     "chai": "^4.3.6",
     "core-js": "^3.22.7",
+    "dompurify": "^2.3.8",
     "eslint": "^6.8.0",
     "eslint-config-habitrpg": "^6.2.0",
     "eslint-plugin-mocha": "^5.3.0",

website/client/src/components/auth/registerLoginReset.vue

@@ -614,6 +614,7 @@ import axios from 'axios';
 import hello from 'hellojs';
 import debounce from 'lodash/debounce';
 import isEmail from 'validator/lib/isEmail';
+import DOMPurify from 'dompurify';
 import { buildAppleAuthUrl } from '../../libs/auth';
 
 import { MINIMUM_PASSWORD_LENGTH } from '@/../../common/script/constants';
@@ -754,6 +755,12 @@ export default {
         }
       });
     }, 500),
+    sanitizeRedirect (redirect) {
+      if (!redirect) return '/';
+      let sanitizedString = DOMPurify.sanitize(redirect).replace(/\\|\/\/|\./g, '');
+      sanitizedString = `/${sanitizedString}`;
+      return sanitizedString;
+    },
     async register () {
       // @TODO do not use alert
       if (!this.email) {
@@ -785,19 +792,14 @@ export default {
         passwordConfirm: this.passwordConfirm,
       });
 
-      let redirectTo;
-
-      if (this.$route.query.redirectTo) {
-        redirectTo = this.$route.query.redirectTo;
-      } else {
-        redirectTo = '/';
-      }
+      const redirectTo = this.sanitizeRedirect(this.$route.query.redirectTo);
 
       // @TODO do not reload entire page
       // problem is that app.vue created hook should be called again
       // after user is logged in / just signed up
       // ALSO it's the only way to make sure language data
       // is reloaded and correct for the logged in user
+      // Same situation in login and socialAuth functions
       window.location.href = redirectTo;
     },
     async login () {
@@ -807,19 +809,8 @@ export default {
         password: this.password,
       });
 
-      let redirectTo;
+      const redirectTo = this.sanitizeRedirect(this.$route.query.redirectTo);
 
-      if (this.$route.query.redirectTo) {
-        redirectTo = this.$route.query.redirectTo;
-      } else {
-        redirectTo = '/';
-      }
-
-      // @TODO do not reload entire page
-      // problem is that app.vue created hook should be called again
-      // after user is logged in / just signed up
-      // ALSO it's the only way to make sure language data
-      // is reloaded and correct for the logged in user
       window.location.href = redirectTo;
     },
     // @TODO: Abstract hello in to action or lib
@@ -842,19 +833,8 @@ export default {
           auth,
         });
 
-        let redirectTo;
+        const redirectTo = this.sanitizeRedirect(this.$route.query.redirectTo);
 
-        if (this.$route.query.redirectTo) {
-          redirectTo = this.$route.query.redirectTo;
-        } else {
-          redirectTo = '/';
-        }
-
-        // @TODO do not reload entire page
-        // problem is that app.vue created hook should be called again
-        // after user is logged in / just signed up
-        // ALSO it's the only way to make sure language data
-        // is reloaded and correct for the logged in user
         window.location.href = redirectTo;
       }
     },