From d44592ddb5f98dcffd0ae3dc74ca90349a231810 Mon Sep 17 00:00:00 2001
From: Mike Cao <mike@umami.is>
Date: Tue, 2 Jun 2026 17:26:48 -0700
Subject: [PATCH] Validate SSO redirect URLs before setting auth token

---
 src/app/sso/SSOPage.tsx | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/app/sso/SSOPage.tsx b/src/app/sso/SSOPage.tsx
index 3cc950938..bf7fbb484 100644
--- a/src/app/sso/SSOPage.tsx
+++ b/src/app/sso/SSOPage.tsx
@@ -4,6 +4,12 @@ import { useRouter, useSearchParams } from 'next/navigation';
 import { useEffect } from 'react';
 import { setClientAuthToken } from '@/lib/client';
 
+function isSafeRedirectUrl(url: string): boolean {
+  // Must start with a single slash (relative path)
+  // Block protocol handlers (javascript:, data:, etc.) and protocol-relative URLs (//)
+  return url.startsWith('/') && !url.startsWith('//') && !url.includes(':');
+}
+
 export function SSOPage() {
   const router = useRouter();
   const search = useSearchParams();
@@ -12,8 +18,12 @@ export function SSOPage() {
 
   useEffect(() => {
     if (url && token) {
-      setClientAuthToken(token);
+      if (!isSafeRedirectUrl(url)) {
+        router.push('/');
+        return;
+      }
 
+      setClientAuthToken(token);
       router.push(url);
     }
   }, [router, url, token]);