Adam Moussa 3daddcd14e fix: reject protocol-relative path from sanitizeAuthRedirect (open redirect) ... sanitizeAuthRedirect returned parsed.pathname+search+hash, which `new URL` can resolve to a protocol-relative `//host` (e.g. input `/..//evil.com` normalizes same-origin, passing the origin check, but yields a path starting with `//`). ClientRedirect / login.tsx feed that path to window.location.replace, so it navigates cross-origin — an open redirect. Reject any resolved path that is not a single-leading-slash path (`^/[^/]`), falling back to the default. Adds coverage for `/..//evil.com`, `/.//evil.com`, and `//evil.com`.		2026-07-09 15:41:03 -04:00
..
components	feat: port plan-review & workflow-approval UX (#135)	2026-07-09 17:11:40 +00:00
lib	fix: reject protocol-relative path from sanitizeAuthRedirect (open redirect)	2026-07-09 15:41:03 -04:00
routes	Merge branch 'dev' into feature/port-plan-review-workflow-approval-ux	2026-07-09 15:10:46 -04:00
styles	feat(ui): reintroduce subtle blue accents on greyscale frontend (#1555)	2026-06-16 19:41:19 -07:00
client.tsx	chore: cherry-pick clean upstream fixes + cherry-pick runbook (#117)	2026-07-03 11:48:40 -04:00
logo.svg	feat: open-swe dashboard for per-user profile config (#1302)	2026-05-15 11:23:53 -07:00
router.tsx	feat: open-swe dashboard for per-user profile config (#1302)	2026-05-15 11:23:53 -07:00
routeTree.gen.ts	chore: cherry-pick deferred reviewer-misc upstream commits (#127)	2026-07-08 17:28:21 -04:00
styles.css	Neutralize frontend: blue accents → neutral aesthetic (#1553)	2026-06-16 15:49:33 -07:00