fix(auth): reject control chars in redirect target

Browsers strip C0 control characters (TAB/LF/CR) from URLs before
navigating, so `/\t/evil.example` and `/\n//evil.example` slipped past
the slash checks and then normalised to a protocol-relative, off-origin
URL. Reject any C0 control char (U+0000-U+001F) up front, before the
slash checks. Add regression tests for the TAB/LF/CR variants.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: dobby-coder[bot]

src/routes/auth/login/safe-redirect.ts

@@ -6,15 +6,33 @@
 
 export const DEFAULT_REDIRECT = '/portal/dashboard';
 
+/**
+ * True if `value` contains any C0 control character (U+0000–U+001F, incl.
+ * TAB/LF/CR). Browsers strip these from URLs before navigating, so a value
+ * like `/\t/evil.example` or `/\n//evil.example` would slip past the slash
+ * checks below and then normalise to a protocol-relative, off-origin URL.
+ * Strip-then-parse is the classic open-redirect bypass, so we reject any such
+ * value up front. (Expressed as a char-code scan to keep literal control
+ * characters out of the source.)
+ */
+function hasControlChar(value: string): boolean {
+	for (let i = 0; i < value.length; i++) {
+		if (value.charCodeAt(i) <= 0x1f) return true;
+	}
+	return false;
+}
+
 /**
  * Return a safe post-login redirect target. A value is only accepted when it
  * begins with a single `/` (a same-origin absolute path). Everything else —
- * empty/missing values, absolute URLs (`https://…`), protocol-relative URLs
- * (`//host`) and the backslash variant browsers normalise to them (`/\host`)
- * — falls back to {@link DEFAULT_REDIRECT}.
+ * empty/missing values, values containing control characters, absolute URLs
+ * (`https://…`), protocol-relative URLs (`//host`) and the backslash variant
+ * browsers normalise to them (`/\host`) — falls back to {@link DEFAULT_REDIRECT}.
  */
 export function safeRedirect(target: string | null | undefined): string {
-	if (!target || !target.startsWith('/')) return DEFAULT_REDIRECT;
+	if (!target) return DEFAULT_REDIRECT;
+	if (hasControlChar(target)) return DEFAULT_REDIRECT;
+	if (!target.startsWith('/')) return DEFAULT_REDIRECT;
 	// Reject protocol-relative URLs. Browsers treat `\` as `/`, so `/\host`
 	// escapes the origin just like `//host` does.
 	if (target[1] === '/' || target[1] === '\\') return DEFAULT_REDIRECT;

tests/unit/safe-redirect.test.ts

@@ -32,4 +32,15 @@ describe('safeRedirect', () => {
 		expect(safeRedirect('/\\evil.example')).toBe(DEFAULT_REDIRECT);
 		expect(safeRedirect('/\\/evil.example')).toBe(DEFAULT_REDIRECT);
 	});
+
+	it('rejects control chars browsers strip before navigating (TAB/LF/CR)', () => {
+		// Browsers drop these, so `/\t/evil.example` etc. would normalise to
+		// `//evil.example` (off-origin) if they slipped past the slash checks.
+		expect(safeRedirect('/\t/evil.example')).toBe(DEFAULT_REDIRECT);
+		expect(safeRedirect('/\n/evil.example')).toBe(DEFAULT_REDIRECT);
+		expect(safeRedirect('/\r/evil.example')).toBe(DEFAULT_REDIRECT);
+		expect(safeRedirect('/\t\\evil.example')).toBe(DEFAULT_REDIRECT);
+		expect(safeRedirect('\t//evil.example')).toBe(DEFAULT_REDIRECT);
+		expect(safeRedirect('/foo\nbar')).toBe(DEFAULT_REDIRECT);
+	});
 });