fix(security): sanitize API redirect_path on login/register (open-redirect)

[venkyden]

Why

login/page.tsx and register/page.tsx pushed the API-supplied redirect_path directly to the router:

router.push(result.redirect_path || '/dashboard');           // register
router.push(safeRedirect || result.redirect_path || '/dashboard'); // login (returnUrl guarded, redirect_path not)

An attacker-influenced redirect_path (//evil.com, javascript:, https://…) would be followed → open redirect. These call sites are pre-existing (identical before the recent feat/verification-kyc churn) and were surfaced during the git audit behind #13. They're separate from the AuthContext guard restored in #13.

Change

• New shared frontend/lib/safeRedirect.ts — safeRedirectPath() accepts only same-origin relative paths; rejects protocol-relative (//), absolute, and protocol-bearing (javascript:, http:) values; decodes first to catch encoded payloads.
• Wrapped redirect_path at all 4 call sites in login/register.

Verification

• tsc --noEmit → clean (0).

Note

AuthContext.tsx (restored in #13) and login's local getSafeRedirectUrl (for the returnUrl query param) have near-identical logic. Consolidating all three onto this shared util is a reasonable, low-risk follow-up — left out here to keep this PR focused on the security gap.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added safer redirect handling after login and registration, helping ensure users land on valid in-app pages.
  • Invalid or unsafe redirect destinations now fall back to a default destination instead of being used directly.

• Bug Fixes

  • Improved post-auth navigation consistency for Google sign-in and email/password flows.
  • Reduced the risk of unexpected redirects caused by malformed or unsupported destination values.

[coderabbitai]

Warning

Review limit reached

@venkyden, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 45 minutes and 4 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 6c2f689f-e7ad-4c44-aaca-a859584e1e2c

📥 Commits

Reviewing files that changed from the base of the PR and between dc9351d and c7c0645.

📒 Files selected for processing (1)

• frontend/lib/safeRedirect.ts

📝 Walkthrough

Walkthrough

Adds a redirect-path sanitizer and routes post-auth navigation in the login and register pages through it instead of using raw redirect values.

Changes

Auth redirect sanitization

Layer / File(s)	Summary
Redirect sanitizer frontend/lib/safeRedirect.ts	Adds safeRedirectPath(path, fallback) to validate inputs, decode encoded paths, reject unsafe targets, and return the fallback when validation fails.
Login redirects frontend/app/auth/login/page.tsx	Imports safeRedirectPath and uses it in the Google and email/password success flows when choosing the next route.
Register redirects frontend/app/auth/register/page.tsx	Imports safeRedirectPath and uses it in the Google sign-in and registration success flows before navigation.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• venkyden/rental-platform#13: Updates the same auth redirect handling to use safeRedirectPath for post-login/register navigation.

Poem

🐇 I hop through paths both safe and sly,
And sniff each redirect before I fly.
No sneaky scheme can steal my trail,
My carrot route will never fail.
Hooray, I land where bunnies may!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the security fix and the affected login/register redirect paths.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/login-register-open-redirect

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@frontend/lib/safeRedirect.ts`:
- Around line 17-21: The safe redirect guard in safeRedirect should also reject
backslashes before the existing prefix/protocol checks, since values like
\evil.com or \/evil.com can still resolve to an external origin in browsers.
Update the validation logic in the safeRedirect function to either fail fast
when the input contains backslashes or normalize them before evaluating the
leading-slash and protocol rules, keeping the existing fallback behavior intact.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ab3b542f-c0b6-4629-83ea-0bbd27e1370c

📥 Commits

Reviewing files that changed from the base of the PR and between b111413 and dc9351d.

📒 Files selected for processing (3)

• frontend/app/auth/login/page.tsx
• frontend/app/auth/register/page.tsx
• frontend/lib/safeRedirect.ts