helpy4/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich synced 2026-08-29 13:15:45 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: maintentance return URL sanitization (#30948)

Browse source
This commit is contained in:
Brandon Wees 2026-08-23 12:49:11 -05:00 • committed by GitHub
parent c98c20e963
commit cbf5d83a69
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 28 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

27
web/src/lib/utils/maintenance.spec.ts Normal file
View file

@ -0,0 +1,27 @@
import { maintenanceReturnUrl } from '$lib/utils/maintenance';
describe('maintenance', () => {
describe(maintenanceReturnUrl.name, () => {
beforeEach(() => {
// @ts-expect-error - override location for testing
// eslint-disable-next-line unicorn/no-global-object-property-assignment
globalThis.location = new URL('https://my.immich.server');
vi.spyOn(document, 'baseURI', 'get').mockReturnValue('https://my.immich.server/');
});
it('should resolve a same-origin continue url', () => {
expect(maintenanceReturnUrl(new URLSearchParams({ continue: '/photos' }))).property(
'href',
'https://my.immich.server/photos',
);
});
it('should fall back to the root route when continue is missing', () => {
expect(maintenanceReturnUrl(new URLSearchParams())).property('href', 'https://my.immich.server/');
});
it('should reject a cross-origin continue url', () => {
expect(maintenanceReturnUrl(new URLSearchParams({ continue: 'https://malicious.site/evil' }))).toBe('/');
});
});
});

2
web/src/lib/utils/maintenance.ts
View file

@ -8,7 +8,7 @@ export function maintenanceCreateUrl(url: URL) {
}
export function maintenanceReturnUrl(searchParams: URLSearchParams) {
return searchParams.get('continue') ?? '/';
return Route.continue(searchParams.get('continue'), '/');
}
export function maintenanceShouldRedirect(maintenanceMode: boolean, currentUrl: URL | Location) {