fix(mcp): validate OAuth base origin

apps/nextjs/src/env.spec.ts

@@ -0,0 +1,22 @@
+import { describe, expect, test } from "vitest";
+
+import { baseUrlSchema } from "./env";
+
+describe("BASE_URL", () => {
+  test.each(["http://localhost:7575", "https://homarr.example.com", "https://homarr.example.com/"])(
+    "accepts the HTTP(S) origin %s",
+    (value) => {
+      expect(baseUrlSchema.safeParse(value).success).toBe(true);
+    },
+  );
+
+  test.each([
+    "ftp://homarr.example.com",
+    "https://user:password@homarr.example.com",
+    "https://homarr.example.com/prefix",
+    "https://homarr.example.com?preview=1",
+    "https://homarr.example.com#preview",
+  ])("rejects the non-origin URL %s", (value) => {
+    expect(baseUrlSchema.safeParse(value).success).toBe(false);
+  });
+});

apps/nextjs/src/env.ts

@@ -1,9 +1,14 @@
 import { createBooleanSchema, createEnv } from "@homarr/core/infrastructure/env";
 import { z } from "zod/v4";
 
+export const baseUrlSchema = z.url({ protocol: /^https?$/ }).refine((value) => {
+  const url = new URL(value);
+  return !url.username && !url.password && url.pathname === "/" && !url.search && !url.hash;
+}, "BASE_URL must be an HTTP(S) origin without credentials, a path, query parameters, or a fragment");
+
 export const env = createEnv({
   server: {
-    BASE_URL: z.string().url().optional(),
+    BASE_URL: baseUrlSchema.optional(),
     UNSAFE_ENABLE_MOCK_INTEGRATION: createBooleanSchema(false),
     DEMO_MODE: createBooleanSchema(false),
     DEMO_READ_ONLY: createBooleanSchema(true),