fix: prevent open redirect via protocol-relative returnTo

Author: yogeshchoudhary147

__tests__/with-authentication-required.test.tsx

@@ -182,6 +182,33 @@ describe('withAuthenticationRequired', () => {
     );
   });
 
+  it('should sanitize protocol-relative returnTo paths to prevent open redirect', async () => {
+    // Simulate a URL like https://app.example.com//evil.com whose pathname is //evil.com.
+    // Routers (react-router, next.js, gatsby) treat //evil.com as a protocol-relative URL
+    // and redirect the user to http://evil.com.
+    window.history.replaceState({}, '', 'https://www.example.com//evil.com');
+
+    mockClient.getUser.mockResolvedValue(undefined);
+    const MyComponent = () => <>Private</>;
+    const WrappedComponent = withAuthenticationRequired(MyComponent);
+    render(
+      <Auth0Provider clientId="__test_client_id__" domain="__test_domain__">
+        <WrappedComponent />
+      </Auth0Provider>
+    );
+    await waitFor(() =>
+      expect(mockClient.loginWithRedirect).toHaveBeenCalledWith(
+        expect.objectContaining({
+          appState: expect.objectContaining({
+            returnTo: '/evil.com',
+          }),
+        })
+      )
+    );
+
+    window.history.replaceState({}, '', 'https://www.example.com/');
+  });
+
   it('should call loginWithRedirect only once even if parent state changes', async () => {
     mockClient.getUser.mockResolvedValue(undefined);
     const MyComponent = () => <>Private</>;

src/with-authentication-required.tsx

@@ -18,8 +18,14 @@ const defaultOnBeforeAuthentication = async (): Promise<void> => {/* noop */ };
 /**
  * @ignore
  */
-const defaultReturnTo = (): string =>
-  `${window.location.pathname}${window.location.search}`;
+const defaultReturnTo = (): string => {
+  // Normalize the pathname to prevent protocol-relative open redirects.
+  // A URL like https://app.example.com//evil.com produces a pathname of
+  // //evil.com, which routers (react-router, next.js, gatsby) interpret as a
+  // protocol-relative URL and redirect the user to an external host.
+  const pathname = window.location.pathname.replace(/^\/\/+/, '/');
+  return `${pathname}${window.location.search}`;
+};
 
 /**
  * Options for the withAuthenticationRequired Higher Order Component