${formattedParagraph}
` }) .join('') + + return sanitizeHtml(result) } export default function Info() { diff --git a/src/pages/Subscription.tsx b/src/pages/Subscription.tsx index 3c782c0..2d82d9d 100644 --- a/src/pages/Subscription.tsx +++ b/src/pages/Subscription.tsx @@ -301,18 +301,20 @@ export default function Subscription() { // Auto-scroll to switch tariff modal when it appears useEffect(() => { if (switchTariffId && switchModalRef.current) { - setTimeout(() => { + const timer = setTimeout(() => { switchModalRef.current?.scrollIntoView({ behavior: 'smooth', block: 'center' }) }, 100) + return () => clearTimeout(timer) } }, [switchTariffId]) // Auto-scroll to tariff purchase form when it appears useEffect(() => { if (showTariffPurchase && tariffPurchaseRef.current) { - setTimeout(() => { + const timer = setTimeout(() => { tariffPurchaseRef.current?.scrollIntoView({ behavior: 'smooth', block: 'center' }) }, 100) + return () => clearTimeout(timer) } }, [showTariffPurchase]) @@ -320,11 +322,12 @@ export default function Subscription() { useEffect(() => { const state = location.state as { scrollToExtend?: boolean } | null if (state?.scrollToExtend && tariffsCardRef.current) { - setTimeout(() => { + const timer = setTimeout(() => { tariffsCardRef.current?.scrollIntoView({ behavior: 'smooth', block: 'center' }) }, 300) // Clear the state to prevent re-scrolling on subsequent renders window.history.replaceState({}, document.title) + return () => clearTimeout(timer) } }, [location.state]) diff --git a/src/pages/TelegramCallback.tsx b/src/pages/TelegramCallback.tsx index 46905cb..5bb6a0f 100644 --- a/src/pages/TelegramCallback.tsx +++ b/src/pages/TelegramCallback.tsx @@ -32,19 +32,27 @@ export default function TelegramCallback() { return } + // Parse and validate numeric fields + const parsedId = parseInt(id, 10) + const parsedAuthDate = parseInt(authDate, 10) + + if (Number.isNaN(parsedId) || Number.isNaN(parsedAuthDate)) { + setError(t('auth.telegramRequired')) + return + } + try { await loginWithTelegramWidget({ - id: parseInt(id, 10), + id: parsedId, first_name: firstName, last_name: lastName || undefined, username: username || undefined, photo_url: photoUrl || undefined, - auth_date: parseInt(authDate, 10), + auth_date: parsedAuthDate, hash: hash, }) navigate('/') } catch (err: unknown) { - console.error('Telegram auth error:', err) const error = err as { response?: { data?: { detail?: string } } } setError(error.response?.data?.detail || t('common.error')) } diff --git a/src/pages/TelegramRedirect.tsx b/src/pages/TelegramRedirect.tsx index 2488db9..3b52b1b 100644 --- a/src/pages/TelegramRedirect.tsx +++ b/src/pages/TelegramRedirect.tsx @@ -5,6 +5,29 @@ import { useQuery } from '@tanstack/react-query' import { useAuthStore } from '../store/auth' import { brandingApi } from '../api/branding' +// Validate redirect URL to prevent open redirect attacks +const getSafeRedirectUrl = (url: string | null): string => { + if (!url) return '/' + // Only allow relative paths starting with / + // Block protocol-relative URLs (//evil.com) and absolute URLs + if (!url.startsWith('/') || url.startsWith('//')) { + return '/' + } + // Additional check for encoded characters that could bypass validation + try { + const decoded = decodeURIComponent(url) + if (!decoded.startsWith('/') || decoded.startsWith('//') || decoded.includes('://')) { + return '/' + } + } catch { + return '/' + } + return url +} + +const MAX_RETRY_ATTEMPTS = 3 +const RETRY_COUNT_KEY = 'telegram_redirect_retry_count' + export default function TelegramRedirect() { const { t } = useTranslation() const navigate = useNavigate() @@ -12,6 +35,10 @@ export default function TelegramRedirect() { const { loginWithTelegram, isAuthenticated, isLoading: authLoading } = useAuthStore() const [status, setStatus] = useState<'loading' | 'success' | 'error' | 'not-telegram'>('loading') const [errorMessage, setErrorMessage] = useState('') + const [retryCount, setRetryCount] = useState(() => { + const stored = sessionStorage.getItem(RETRY_COUNT_KEY) + return stored ? parseInt(stored, 10) : 0 + }) // Get branding for nice display const { data: branding } = useQuery({ @@ -24,8 +51,8 @@ export default function TelegramRedirect() { const logoLetter = branding?.logo_letter || import.meta.env.VITE_APP_LOGO || 'V' const logoUrl = branding ? brandingApi.getLogoUrl(branding) : null - // Get redirect target from URL params - const redirectTo = searchParams.get('redirect') || '/' + // Get redirect target from URL params (validated) + const redirectTo = getSafeRedirectUrl(searchParams.get('redirect')) useEffect(() => { // If already authenticated, redirect immediately @@ -76,13 +103,28 @@ export default function TelegramRedirect() { setTimeout(initTelegram, 300) }, [loginWithTelegram, navigate, isAuthenticated, authLoading, redirectTo, t]) - // Handle retry + // Handle retry with limit to prevent infinite loops const handleRetry = () => { + if (retryCount >= MAX_RETRY_ATTEMPTS) { + setErrorMessage('Превышено количество попыток. Попробуйте позже.') + sessionStorage.removeItem(RETRY_COUNT_KEY) + return + } + const newCount = retryCount + 1 + setRetryCount(newCount) + sessionStorage.setItem(RETRY_COUNT_KEY, String(newCount)) setStatus('loading') setErrorMessage('') window.location.reload() } + // Clear retry count on successful auth + useEffect(() => { + if (status === 'success') { + sessionStorage.removeItem(RETRY_COUNT_KEY) + } + }, [status]) + return (