fix: validate next redirect param to prevent open redirect vulnerability (#827)

[namann5]

Summary

Fixes #827 — the OAuth callback handler used the
ext\ query parameter directly as the redirect path without validation, enabling an open redirect attack.

Vulnerability

An attacker could craft a URL like \https://coders-ogs.xyz/api/auth/callback?code=<valid_code>&next=https://evil.com/phishing\ to silently redirect users to an attacker-controlled domain after OAuth completes.

Fix

Validate that
ext\ is a safe relative path:

• Reject paths that don't start with /\
• Reject protocol-relative URLs (//evil.com)
• Reject URLs containing ://\
• Fall back to /dashboard\ for unsafe values

Changes

• \src/app/api/auth/callback/route.ts: Validate
  ext\ param before using it as the redirect path

Closes #827

[vercel]

@namann5 is attempting to deploy a commit to the codersogs-3057's projects Team on Vercel.

A member of the Team first needs to authorize it.

[jakharmonika364]

Good defensive check, and it matches the issue's suggested fix.

One thing worth knowing before treating this as fixing a live "critical" vuln: url.pathname = next (both before and after this PR) can't actually produce a cross-origin redirect - I tested it against Next.js's actual NextURL implementation, which delegates straight to the WHATWG URL.pathnam setter, and that setter is spec-confined to path parsing, so it can never re-introduce a scheme/host. next=https://evil.com ends up as coders-ogs.xyz/https://evil.com, not a redirect off-site. Still worth merging as defense-in-depth (protects us if this ever gets refactored to redirect(next) or url.href = next), but the severity in #827 is overstated for the current code.

Could you add a couple of unit tests for the new branch (next=https://evil.com, next=//evil.com, next=/settings) since there's no test file for this route yet?

[namann5]

@jakharmonika364 thanks for the detail on NextURL — good to know the current code can't actually redirect off-site. Agreed it's defense-in-depth; I've kept the validation as-is.

Added the requested unit tests in 691ee27 (new src/app/api/auth/callback/route.test.ts, 3 tests):

ext=/settings → redirects to /settings

ext=https://evil.com/phishing → falls back to /dashboard

ext=//evil.com/phishing → falls back to /dashboard
All pass, lint clean.

[jakharmonika364]

LGTM, thanks!