c0mrade b4f066942a fix(security): validate the deep-link url in miniapp/redirect.html (open redirect + DOM-XSS) ...

public/miniapp/redirect.html read the `url` query param and assigned it to both
the manual <a href> and window.location.href with no validation. Served on the
cabinet's own origin, this was an open redirect (phishing) and — in Telegram /
WebView contexts that execute javascript: URIs in top-level navigation — a
DOM-XSS able to exfiltrate the refresh_token from localStorage (account takeover).

Add isSafeAppLink(): only a custom app deep link passes (scheme://, excluding
http/https/file/blob/about/intent/content and the javascript/data/vbscript
script schemes); anything else renders the no-URL state instead of navigating or
setting href. Mirrors the validation already in src/pages/DeepLinkRedirect.tsx.

2026-06-04 16:54:50 +03:00

..

redirect.html

fix(security): validate the deep-link url in miniapp/redirect.html (open redirect + DOM-XSS)

2026-06-04 16:54:50 +03:00