Validate SSO redirect URLs before setting auth token

src/app/sso/SSOPage.tsx

@@ -4,6 +4,12 @@ import { useRouter, useSearchParams } from 'next/navigation';
 import { useEffect } from 'react';
 import { setClientAuthToken } from '@/lib/client';
 
+function isSafeRedirectUrl(url: string): boolean {
+  // Must start with a single slash (relative path)
+  // Block protocol handlers (javascript:, data:, etc.) and protocol-relative URLs (//)
+  return url.startsWith('/') && !url.startsWith('//') && !url.includes(':');
+}
+
 export function SSOPage() {
   const router = useRouter();
   const search = useSearchParams();
@@ -12,8 +18,12 @@ export function SSOPage() {
 
   useEffect(() => {
     if (url && token) {
-      setClientAuthToken(token);
+      if (!isSafeRedirectUrl(url)) {
+        router.push('/');
+        return;
+      }
 
+      setClientAuthToken(token);
       router.push(url);
     }
   }, [router, url, token]);