bug: fix open redirect in routes/index.js (SonarQube jssecurity:S5146)

Restrict the post-login redirect target to same-site relative paths so a
user-controlled value (req.body.redirectPage) can no longer trigger an
open redirect to an external site. Addresses SonarQube issue
AZhSVLrd4wErqc9Ey1Y4 (rule jssecurity:S5146) at routes/index.js:61.

Co-Authored-By: Joao Esteves <joao.esteves@cognition.ai>

Author: devin-ai-integration[bot]

routes/index.js

@@ -51,13 +51,23 @@ exports.loginHandler = function (req, res, next) {
   }
 };
 
+// Only allow same-site, relative redirect targets to prevent open redirects.
+// Rejects absolute URLs (e.g. "https://evil.com") and protocol-relative
+// URLs (e.g. "//evil.com" or "/\evil.com").
+function isSafeRedirectTarget(target) {
+  return typeof target === 'string'
+    && target.startsWith('/')
+    && !target.startsWith('//')
+    && !target.startsWith('/\\')
+}
+
 function adminLoginSuccess(redirectPage, session, username, res) {
   session.loggedIn = 1
 
   // Log the login action for audit
   console.log(`User logged in: ${username}`)
 
-  if (redirectPage) {
+  if (isSafeRedirectTarget(redirectPage)) {
       return res.redirect(redirectPage)
   } else {
       return res.redirect('/admin')