fix(sicurezza): safeNext blocca backslash (open redirect) + guardia ownership su /admin/edit

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-05 22:34:16 +02:00
parent e2bbc9074f
commit 7211d74d3a
3 changed files with 6 additions and 1 deletions
@@ -14,5 +14,7 @@ describe('safeNext', () => {
    expect(safeNext('/api/admin/posts')).toBe('/');
    expect(safeNext('javascript:alert(1)')).toBe('/');
    expect(safeNext('not-a-path')).toBe('/');
+    expect(safeNext('/\\evil.com')).toBe('/');
+    expect(safeNext('/\\/evil.com')).toBe('/');
  });
 });