fix(config): ignore non relative return paths on the maintenance redirect

apps/deploy-web/src/middleware.spec.ts

@@ -84,6 +84,30 @@ describe("middleware", () => {
     expect(response.headers.get("location")).toBe("http://localhost/deployments");
   });
 
+  it("redirects to the requested relative path when leaving the maintenance page", () => {
+    const { response } = setup({ path: "/maintenance?return=%2Fdeployments%3Ftab%3Dactive" });
+
+    expect(response.headers.get("location")).toBe("http://localhost/deployments?tab=active");
+  });
+
+  it("ignores an absolute return url when leaving the maintenance page", () => {
+    const { response } = setup({ path: "/maintenance?return=https%3A%2F%2Fevil.example%2Fphish" });
+
+    expect(response.headers.get("location")).toBe("http://localhost/");
+  });
+
+  it("ignores a protocol relative return url when leaving the maintenance page", () => {
+    const { response } = setup({ path: "/maintenance?return=%2F%2Fevil.example%2Fphish" });
+
+    expect(response.headers.get("location")).toBe("http://localhost/");
+  });
+
+  it("ignores a backslash prefixed return url when leaving the maintenance page", () => {
+    const { response } = setup({ path: "/maintenance?return=%2F%5Cevil.example%2Fphish" });
+
+    expect(response.headers.get("location")).toBe("http://localhost/");
+  });
+
   function setup(input: { path: string }) {
     const request = new NextRequest(new URL(`http://localhost${input.path}`));
     const response = middleware(request);

apps/deploy-web/src/middleware.ts

@@ -85,8 +85,11 @@ function getReturnPath(request: NextRequest) {
   try {
     const returnParam = request.nextUrl.searchParams.get("return");
     const returnPath = returnParam ? decodeURIComponent(returnParam) : "/";
+    const requestUrl = new URL(request.url);
+    const returnUrl = new URL(returnPath, requestUrl);
+    const isSameOrigin = returnUrl.origin === requestUrl.origin;
 
-    return returnPath;
+    return isSameOrigin ? `${returnUrl.pathname}${returnUrl.search}${returnUrl.hash}` : "/";
   } catch (error) {
     logger.error({ message: "Failed to get return path", error });
     return "/";

apps/stats-web/src/middleware.spec.ts

@@ -0,0 +1,36 @@
+import { NextRequest } from "next/server";
+import { describe, expect, it } from "vitest";
+
+import { middleware } from "./middleware";
+
+describe("middleware", () => {
+  it("redirects to the requested relative path when leaving the maintenance page", () => {
+    const { response } = setup({ path: "/maintenance?return=%2Fgraph%2Fdaily-akt-spent" });
+
+    expect(response.headers.get("location")).toBe("http://localhost/graph/daily-akt-spent");
+  });
+
+  it("ignores an absolute return url when leaving the maintenance page", () => {
+    const { response } = setup({ path: "/maintenance?return=https%3A%2F%2Fevil.example%2Fphish" });
+
+    expect(response.headers.get("location")).toBe("http://localhost/");
+  });
+
+  it("ignores a protocol relative return url when leaving the maintenance page", () => {
+    const { response } = setup({ path: "/maintenance?return=%2F%2Fevil.example%2Fphish" });
+
+    expect(response.headers.get("location")).toBe("http://localhost/");
+  });
+
+  it("ignores a backslash prefixed return url when leaving the maintenance page", () => {
+    const { response } = setup({ path: "/maintenance?return=%2F%5Cevil.example%2Fphish" });
+
+    expect(response.headers.get("location")).toBe("http://localhost/");
+  });
+
+  function setup(input: { path: string }) {
+    const request = new NextRequest(new URL(`http://localhost${input.path}`));
+    const response = middleware(request);
+    return { request, response };
+  }
+});

apps/stats-web/src/middleware.ts

@@ -64,8 +64,11 @@ function getReturnPath(request: NextRequest) {
   try {
     const returnParam = request.nextUrl.searchParams.get("return");
     const returnPath = returnParam ? decodeURIComponent(returnParam) : "/";
+    const requestUrl = new URL(request.url);
+    const returnUrl = new URL(returnPath, requestUrl);
+    const isSameOrigin = returnUrl.origin === requestUrl.origin;
 
-    return returnPath;
+    return isSameOrigin ? `${returnUrl.pathname}${returnUrl.search}${returnUrl.hash}` : "/";
   } catch (error) {
     logger.error({ message: "Failed to get return path", error });
     return "/";