Function safeReturnTo

apps/cloud/src/auth/return-to.ts:17–33

(path: string | null | undefined)

/** Parse a same-origin landing path, or return null for absent or unsafe input. */
export const safeReturnTo = (path: string | null | undefined): string | null => {
  if (!path || !path.startsWith("/") || path.startsWith("//")) return null;
  // Browsers treat backslashes as path separators and strip some control
  // characters. Reject those spellings before interpreting the destination.
  for (const character of path) {
    if (character === "\\" || character <= " " || character === "\u007f") return null;
  }

  // The fixed origin and single leading slash guarantee a parseable URL.
  // Check the normalized pathname so dot segments cannot bypass the API gate.
  const destination = new URL(path, RETURN_TO_ORIGIN);
  if (destination.origin !== RETURN_TO_ORIGIN) return null;
  if (/^\/api(\/|$)/.test(destination.pathname) && destination.pathname !== "/api/oauth/callback") {
    return null;
  }
  return `${destination.pathname}${destination.search}${destination.hash}`;
};

/** Whether a value parses as a same-origin landing path. */
export const isSafeReturnTo = (path: string): boolean => safeReturnTo(path) !== null;