Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
Merge pull request from GHSA-wq85-q492-8vxv
* Fix open redirect

* Code REview
  • Loading branch information
mmiszy committed Jun 16, 2023
1 parent ca86cd6 commit c29aab2
Show file tree
Hide file tree
Showing 2 changed files with 7 additions and 4 deletions.
6 changes: 4 additions & 2 deletions apps/storefront/components/AccountLayout/AccountLayout.tsx
Expand Up @@ -23,8 +23,10 @@ export function AccountLayout({ children }: AccountLayoutProps) {
);
}

if (!authenticated && typeof window !== "undefined") {
void router.push(paths.account.login.$url({ query: { next: router?.pathname } }));
if (!authenticated) {
if (router.isReady && typeof window !== "undefined") {
void router.replace(paths.account.login.$url({ query: { next: router?.asPath } }));
}
return null;
}

Expand Down
5 changes: 3 additions & 2 deletions apps/storefront/pages/[channel]/[locale]/account/login.tsx
Expand Up @@ -40,8 +40,6 @@ function LoginPage() {
} = useForm<LoginFormData>({ defaultValues });

const routerQueryNext = router.query.next?.toString() || "";
const isExternalUrl = /^\w+:\/\//.test(routerQueryNext);
const redirectURL = !routerQueryNext || isExternalUrl ? paths.$url() : routerQueryNext;

const handleLogin = handleSubmitForm(async (formData: LoginFormData) => {
const { data } = await signIn({
Expand All @@ -54,6 +52,9 @@ function LoginPage() {
return;
}

const redirectURL =
(routerQueryNext && new URL(routerQueryNext, window.location.toString()).pathname) ||
paths.$url();
void router.push(redirectURL);
});

Expand Down

0 comments on commit c29aab2

Please sign in to comment.