security: constrain prompt return navigation

Author: Henry

src/app/prompts/edit/[id]/page.tsx

@@ -8,6 +8,7 @@ import { Prompt, PromptEditorSaveData } from '@/types'
 import { api } from '@/lib/api'
 import { useAuth } from '@/contexts/AuthContext'
 import { Loader2 } from 'lucide-react'
+import { normalizeInternalReturnPath } from '@/lib/navigation-policy'
 import { toast } from '@/hooks/use-toast'
 
 export default function EditPromptPage() {
@@ -21,7 +22,7 @@ export default function EditPromptPage() {
   useEffect(() => {
     if (typeof window !== 'undefined') {
       const searchParams = new URLSearchParams(window.location.search)
-      setReturnPath(searchParams.get('return') || '/prompts')
+      setReturnPath(normalizeInternalReturnPath(searchParams.get('return')))
     }
   }, [])
 

src/lib/navigation-policy.ts

@@ -0,0 +1,87 @@
+const DEFAULT_INTERNAL_RETURN_PATH = '/prompts'
+const INTERNAL_NAVIGATION_ORIGIN = 'https://noteprompt.invalid'
+const MAX_INTERNAL_RETURN_PATH_LENGTH = 2_048
+const MAX_DECODE_PASSES = 4
+
+const CONTROL_OR_DIRECTIONAL_CHARACTERS = /[\u0000-\u001F\u007F-\u009F\u2028\u2029\u202A-\u202E\u2066-\u2069]/
+const MALFORMED_PERCENT_ESCAPE = /%(?![0-9A-Fa-f]{2})/
+const ENCODED_PATH_SEPARATOR = /%(?:25)*(?:2f|5c)/i
+const ENCODED_ASCII_CONTROL = /%(?:25)*(?:0[0-9a-f]|1[0-9a-f]|7f)/i
+const ENCODED_C1_CONTROL = /%(?:25)*c2%(?:25)*[89][0-9a-f]/i
+const ENCODED_UNICODE_CONTROL = /%(?:25)*e2%(?:25)*(?:80%(?:25)*a[89a-e]|81%(?:25)*a[6-9])/i
+
+function hasUnsafeEncodedPath(rawPath: string) {
+  if (
+    MALFORMED_PERCENT_ESCAPE.test(rawPath)
+    || ENCODED_PATH_SEPARATOR.test(rawPath)
+    || ENCODED_ASCII_CONTROL.test(rawPath)
+    || ENCODED_C1_CONTROL.test(rawPath)
+    || ENCODED_UNICODE_CONTROL.test(rawPath)
+  ) return true
+
+  let decodedPath = rawPath
+  for (let pass = 0; pass < MAX_DECODE_PASSES; pass += 1) {
+    let nextPath: string
+    try {
+      nextPath = decodeURIComponent(decodedPath)
+    } catch {
+      return true
+    }
+
+    if (
+      CONTROL_OR_DIRECTIONAL_CHARACTERS.test(nextPath)
+      || nextPath.includes('\\')
+      || ENCODED_PATH_SEPARATOR.test(nextPath)
+      || ENCODED_ASCII_CONTROL.test(nextPath)
+      || ENCODED_C1_CONTROL.test(nextPath)
+      || ENCODED_UNICODE_CONTROL.test(nextPath)
+    ) return true
+
+    if (nextPath === decodedPath) return false
+    decodedPath = nextPath
+  }
+
+  // Deep recursive encoding has no valid navigation use in NotePrompt. Failing
+  // closed avoids a future decoder turning a reviewed path into a separator.
+  return /%[0-9A-Fa-f]{2}/.test(decodedPath)
+}
+
+/**
+ * Accepts only a normalized, same-origin application path for client-side
+ * navigation. Invalid or ambiguous values collapse to one fixed safe route.
+ */
+export function normalizeInternalReturnPath(value: unknown): string {
+  if (typeof value !== 'string') return DEFAULT_INTERNAL_RETURN_PATH
+  if (
+    value.length === 0
+    || value.length > MAX_INTERNAL_RETURN_PATH_LENGTH
+    || value.trim() !== value
+    || value[0] !== '/'
+    || value[1] === '/'
+    || value.includes('\\')
+    || CONTROL_OR_DIRECTIONAL_CHARACTERS.test(value)
+    || ENCODED_ASCII_CONTROL.test(value)
+    || ENCODED_C1_CONTROL.test(value)
+    || ENCODED_UNICODE_CONTROL.test(value)
+  ) return DEFAULT_INTERNAL_RETURN_PATH
+
+  const pathEnd = value.search(/[?#]/)
+  const rawPath = pathEnd === -1 ? value : value.slice(0, pathEnd)
+  if (hasUnsafeEncodedPath(rawPath)) return DEFAULT_INTERNAL_RETURN_PATH
+
+  try {
+    const parsed = new URL(value, INTERNAL_NAVIGATION_ORIGIN)
+    const normalizedPath = parsed.pathname
+    if (
+      parsed.origin !== INTERNAL_NAVIGATION_ORIGIN
+      || normalizedPath[0] !== '/'
+      || normalizedPath[1] === '/'
+      || normalizedPath.includes('\\')
+      || CONTROL_OR_DIRECTIONAL_CHARACTERS.test(normalizedPath)
+    ) return DEFAULT_INTERNAL_RETURN_PATH
+
+    return `${normalizedPath}${parsed.search}${parsed.hash}`
+  } catch {
+    return DEFAULT_INTERNAL_RETURN_PATH
+  }
+}

tests/navigation-policy.test.mjs

@@ -0,0 +1,87 @@
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import path from 'node:path'
+import test from 'node:test'
+
+import { normalizeInternalReturnPath } from '../src/lib/navigation-policy.ts'
+
+const projectRoot = path.resolve(import.meta.dirname, '..')
+const fallback = '/prompts'
+
+test('internal return paths preserve safe application navigation', () => {
+  for (const [candidate, expected] of [
+    ['/prompts', '/prompts'],
+    ['/prompts?lang=en', '/prompts?lang=en'],
+    ['/folders/42?lang=en#details', '/folders/42?lang=en#details'],
+    ['/folders/42/../43', '/folders/43'],
+    ['/folders/%E4%B8%AD%E6%96%87', '/folders/%E4%B8%AD%E6%96%87'],
+    ['/search?next=https%3A%2F%2Fexample.com%2Fx#results', '/search?next=https%3A%2F%2Fexample.com%2Fx#results'],
+    ['/search?q=100%25', '/search?q=100%25'],
+  ]) assert.equal(normalizeInternalReturnPath(candidate), expected, candidate)
+})
+
+test('external, ambiguous, malformed, and control-bearing return paths fail closed', () => {
+  const decodedProtocolRelative = new URLSearchParams('return=%2F%2Fevil.example').get('return')
+  const decodedBackslashes = new URLSearchParams('return=%5C%5Cevil.example').get('return')
+  const decodedJavascript = new URLSearchParams('return=javascript%3Aalert%281%29').get('return')
+
+  const invalidValues = [
+    null,
+    undefined,
+    42,
+    new String('/prompts'),
+    '',
+    'prompts',
+    ' /prompts',
+    '/prompts ',
+    'https://evil.example/path',
+    'http://evil.example/path',
+    'javascript:alert(1)',
+    'data:text/html,unsafe',
+    'mailto:test@example.com',
+    decodedProtocolRelative,
+    decodedBackslashes,
+    decodedJavascript,
+    '//evil.example',
+    '///evil.example',
+    '\\evil.example',
+    '/\\evil.example',
+    '/safe/%2f%2fevil.example',
+    '/safe/%252f%252fevil.example',
+    '/safe/%5c%5cevil.example',
+    '/safe/%255c%255cevil.example',
+    '/safe%0d',
+    '/safe%250d',
+    '/safe%C2%80',
+    '/safe%25C2%2580',
+    '/safe%E2%80%A8',
+    '/safe%25E2%2580%25A8',
+    '/safe\u0000',
+    '/safe\u202e',
+    '/bad%',
+    '/bad%2',
+    '/safe/..//evil.example',
+    '/%2e%2e//evil.example',
+    '/.//evil.example',
+    `/${'a'.repeat(2_048)}`,
+  ]
+
+  for (const candidate of invalidValues) {
+    assert.equal(normalizeInternalReturnPath(candidate), fallback, String(candidate))
+  }
+})
+
+test('the prompt editor normalizes return once before every navigation sink', () => {
+  const route = fs.readFileSync(
+    path.join(projectRoot, 'src/app/prompts/edit/[id]/page.tsx'),
+    'utf8',
+  )
+
+  assert.match(route, /import \{ normalizeInternalReturnPath \} from '@\/lib\/navigation-policy'/)
+  assert.match(
+    route,
+    /setReturnPath\(normalizeInternalReturnPath\(searchParams\.get\('return'\)\)\)/,
+  )
+  assert.doesNotMatch(route, /setReturnPath\(searchParams\.get\('return'\)/)
+  assert.equal((route.match(/router\.push\(returnPath\)/g) || []).length, 4)
+})