Improve sanity checking for signin "from" param

keystonejs · Jul 23, 2018 · 1c93aa2 · 1c93aa2
1 parent e26ad60
commit 1c93aa2
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/admin/client/Signin/index.js b/admin/client/Signin/index.js
@@ -10,9 +10,10 @@ import React from 'react';
 import ReactDOM from 'react-dom';
 import Signin from './Signin';
 
+// Sanitize from param
+const internalFromRegex = /^\/[^\/\\]\w+/;
 const params = qs.parse(window.location.search.replace(/^\?/, ''));
-const from = typeof params.from === 'string' && params.from.charAt(0) === '/'
-	? params.from : undefined;
+const from = internalFromRegex.test(params.from) ? params.from : undefined;
 
 ReactDOM.render(
 	<Signin