core: fix js redirect

koush · Oct 12, 2023 · ee68fcd · ee68fcd
1 parent af6e18d
commit ee68fcd
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 3 deletions.
diff --git a/plugins/core/package-lock.json b/plugins/core/package-lock.json
diff --git a/plugins/core/package.json b/plugins/core/package.json
@@ -1,6 +1,6 @@
 {
    "name": "@scrypted/core",
-   "version": "0.1.142",
+   "version": "0.1.143",
    "description": "Scrypted Core plugin. Provides the UI, websocket, and engine.io APIs.",
    "author": "Scrypted",
    "license": "Apache-2.0",

diff --git a/plugins/core/ui/src/Login.vue b/plugins/core/ui/src/Login.vue
@@ -112,6 +112,16 @@ export default {
         try {
           const redirect_uri = new URL(window.location).searchParams.get('redirect_uri');
           if (redirect_uri) {
+            try {
+              const parsed = new URL(redirect_uri);
+              // allow everything but javascript evaluation within this browser (ie, custom uri handlers, https, etc are all valid)
+              if (parsed.protocol === 'javascript:') {
+                window.location = '/';
+                return;
+              }
+            }
+            catch (e) {
+            }
             window.location = redirect_uri;
             return;
           }