chore: prevent ssrf

cartridge-gg · Aug 25, 2024 · 4b2c8a4 · 4b2c8a4
1 parent 6d4c56f
commit 4b2c8a4
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/packages/keychain/src/pages/session.tsx b/packages/keychain/src/pages/session.tsx
@@ -129,7 +129,7 @@ function sanitizeCallbackUrl(url: string): URL | undefined {
   try {
     const parsed = new URL(url);
 
-    if (parsed.hostname.endsWith("cartridge.gg")) {
+    if (parsed.hostname.endsWith("cartridge.gg") || (parsed.pathname !== "/" && parsed.pathname !== "/callback")) {
       throw new Error(`Invalid callback url: ${url}`);
     }