v0.5.175: safeReturn fix, stack trace не утекает

2026-06-22 19:31:11 +04:00
parent df697cd703
commit 68c3edd8d8
4 changed files with 4 additions and 4 deletions
@@ -528,7 +528,7 @@ function httpPost(url, body, headers) {
 * Защита от open redirect: //evil.com и https://evil.com → '/'.
 */
 function safeReturn(target) {
-  if (typeof target === 'string' && target.startsWith('/') && !target.startsWith('//')) {
+  if (typeof target === 'string' && target.startsWith('/') && !target.startsWith('//') && target[1] !== '\\') {
    return target;
  }
  return '/';