fix: keep normalized return paths same-origin

[nicknisi]

Summary

Keep sanitizeReturnPathname output same-origin when non-special URL schemes preserve backslashes in their paths.

• Reject authority-like backslash prefixes and verify the origin after reconstructing the relative URL.
• Apply the same checks to the fallback, including input targeting the sanitizer's own throwaway hostname.
• Add unit regressions and authorization-to-callback round-trip coverage. Legitimate paths, query strings, and fragments remain supported.

No public API changes or new dependencies.

Verification

• Before the fix, the focused suite had 10 new regression failures: the returned locations resolved off-origin, both in the helper and through the actual callback flow.
• pnpm test: 285 tests passed, 16 suites.
• pnpm typecheck, pnpm build, pnpm lint: passed.
• Formatting checks on changed files and git diff --check: passed.
• Independent review: no blockers.

Browser behavior

A local HTTP harness emitted redirects using the baseline and fixed implementations. Checked browser actions confirmed:

• Baseline: clicking the baseline test reached a second loopback origin, displaying “Cross-origin destination reached.”
• Fixed: clicking the fixed test stayed on the app origin, displaying “Safe same-origin landing.”

The browser harness verified actual redirect interpretation, not a live WorkOS login. In-tree callback tests exercise real state encryption with mocked WorkOS/storage boundaries.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the sanitizer closes the identified open-redirect path without disrupting documented return-path behavior.

Summary

This PR strengthens return-path sanitization against opaque URL paths containing authority-like backslashes and applies the same validation to fallback values.

• Re-resolves reconstructed relative URLs and verifies that they remain on the throwaway origin.
• Rejects authority-like backslash prefixes, including values targeting the sanitizer’s placeholder hostname.
• Adds utility and callback round-trip regressions while preserving legitimate paths, query strings, and fragments.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Untrusted return path] --> B[Parse against throwaway origin]
  B --> C[Reconstruct relative path]
  C --> D{Authority-like prefix or changed origin?}
  D -- No --> E[Return same-origin path]
  D -- Yes --> F[Try sanitized fallback]
  F --> G[Return fallback or root]

Loading

_{Reviews (1) · Last reviewed commit: "fix: keep normalized return paths same-o..."}