feat: add check for at signs in redirect url

[davidsoderberg]

Fixing the redirect vulnerability in github oauth endpoint.

[linear]

NV-2228 Open redirect vulnerability

Description

An open redirect vulnerability exists in `/v1/auth/github/callback`. 
An attacker can exploit the vulnerability by tricking a victim to click the malicious URL.
A successful exploit allows the attacker to log into novu as the victim.

The vulnerable code: `https://github.com/novuhq/novu/blob/5f94d65b1ab8d618aed9768a6e2877a1614e10d8/apps/api/src/app/auth/auth.controller.ts#L94-L96`.

Steps to reproduce

Prerequisite: Enable Sign In with GitHub functionality.

0. [Attacker] Send the following URL to the victim: `https://<novu_api>/v1/auth/github?source=web&redirectUrl=http://localhost:pass<attacker_server>/`
1. [Victim] Open the URL in your web browser.
2. [Victim] Log into GitHub if not.
3. [Victim] You will be redirected to `https://<novu_api>/v1/auth/github/callback?code=&state=%7B%22source%22%3A%22web%22%2C%22redirectUrl%22%3A%22http%3A%2F%2Flocalhost%3Apass%40<attacker_server>%2F%22%7D` in turn `http://localhost:pass<attacker_server>/?token=<JWT_token>`.
4. [Attacker] Get the `<JWT_token>` value sent by the victim on step 3 by inspecting the server's log.
5. [Attacker] Open the following URL in your web browser: `https://<novu_web>/auth/login?token=<JWT_token>`
6. [Attacker] Confirm you logged in as the victim.

[p-fernandez]

Are we missing the check for the question mark? Based on the PR title.

[davidsoderberg]

Me and Dima discussed and said it was not needed after I had created the pr :)

[scopsy]

No, it was not needed in the end :) I see David updated the title