Open redirect fix and improved declarative redirects

This release fixes a medium-severity open redirect vulnerability in route-generated URLs and improves declarative redirects.

Security

Route parameters are now encoded as individual path segments when generating URLs.

Previously, applications passing untrusted input as the first dynamic route segment could generate a scheme-relative URL. When used with Response.redirect().toRoute(), this could redirect users to an attacker-controlled website.

Applications may be affected when request-derived data is passed to route URL builders such as Router.makeUrl() or Response.redirect().toRoute().

Users should upgrade to:

• @adonisjs/http-server@9.3.0 when using AdonisJS v7
• @adonisjs/http-server@8.2.3 when using AdonisJS v6

Full details are available in the GitHub Security Advisory.

Improvements

Declarative redirects can now forward the incoming request query string using the forwardQueryString option.

router
  .on('/')
  .redirect('dashboard', {}, {
    forwardQueryString: true,
  })

The option is supported by both redirect() and redirectToPath().

Full changelog: v9.2.0...v9.3.0