Function safeNextPath

telemetry-dashboard/src/index.ts:126–130

* Only same-origin absolute paths survive, so `?next=` can never become an open * redirect. `//evil.example` and `/\evil.example` are protocol-relative URLs in * a browser, not paths — hence the second character check.

(candidate: string | null)

 * a browser, not paths — hence the second character check.
 */
function safeNextPath(candidate: string | null): string {
  if (!candidate || !candidate.startsWith('/')) return '/';
  if (candidate.startsWith('//') || candidate.startsWith('/\\')) return '/';
  return candidate;
}

function loginRedirect(url: URL): Response {
  const next = `${url.pathname}${url.search}`;