Merge commit from fork

apps/nextjs/src/app/[locale]/auth/login/_login-form.tsx

@@ -7,14 +7,21 @@ import { Anchor, Button, Card, Code, Collapse, Divider, PasswordInput, Stack, Te
 import { useDisclosure } from "@mantine/hooks";
 import { z } from "zod/v4";
 
+
+
 import { signIn } from "@homarr/auth/client";
 import { revalidatePathActionAsync } from "@homarr/common/client";
 import type { useForm } from "@homarr/form";
 import { useZodForm } from "@homarr/form";
 import { showErrorNotification, showSuccessNotification } from "@homarr/notifications";
 import { useScopedI18n } from "@homarr/translation/client";
+import { sanitizeRedirectionUrl } from "@homarr/validation/redirection-url";
 import { userSignInSchema } from "@homarr/validation/user";
 
+
+
+
+
 type Provider = "credentials" | "ldap" | "oidc";
 
 interface LoginFormProps {
@@ -70,7 +77,7 @@ export const LoginForm = ({ providers, oidcClientName, isOidcAutoLoginEnabled, c
 
       // Redirect to the callback URL if the response is defined and comes from a credentials provider (ldap or credentials). oidc is redirected automatically.
       await revalidatePathActionAsync("/");
-      router.push(callbackUrl);
+      router.push(sanitizeRedirectionUrl(callbackUrl));
     },
     [t, router, callbackUrl],
   );

apps/nextjs/src/app/[locale]/auth/login/page.tsx

@@ -7,6 +7,7 @@ import { getScopedI18n } from "@homarr/translation/server";
 
 import { HomarrLogoWithTitle } from "~/components/layout/logo/homarr-logo";
 import { LoginForm } from "./_login-form";
+import { sanitizeRedirectionUrl } from "@homarr/validation/redirection-url";
 
 interface LoginProps {
   searchParams: Promise<{
@@ -19,7 +20,7 @@ export default async function Login(props: LoginProps) {
   const session = await auth();
 
   if (session) {
-    redirect(searchParams.callbackUrl ?? "/");
+    redirect(sanitizeRedirectionUrl(searchParams.callbackUrl));
   }
 
   const t = await getScopedI18n("user.page.login");

packages/validation/src/redirection-url.ts

@@ -0,0 +1,14 @@
+/**
+ * Sanitizes the URL from malicious payloads.
+ * Prevents open redirects such as //example.com/path
+ * and prevents XSS such as javascript:().
+ * Returns / as a default or when unsafe.
+ * @param url The URL to sanitize
+ */
+export const sanitizeRedirectionUrl = (url?: string) => {
+  if (url && url.startsWith("/") && !url.startsWith("//")) {
+    return url;
+  } else {
+    return '/'; // Safe default
+  }
+}