From 66a272fb8be6dc6dc77f5f50c07ea26536b8fe22 Mon Sep 17 00:00:00 2001
From: forehalo <forehalo@gmail.com>
Date: Wed, 17 Apr 2024 03:25:31 +0000
Subject: [PATCH] fix(core): unable to redirect to same origin paths (#6586)

---
 packages/frontend/core/src/pages/redirect.tsx | 24 +++++++++++++------
 packages/frontend/core/src/utils/popup.ts     |  3 +++
 2 files changed, 20 insertions(+), 7 deletions(-)

diff --git a/packages/frontend/core/src/pages/redirect.tsx b/packages/frontend/core/src/pages/redirect.tsx
index 9b2bd7790..4646debf3 100644
--- a/packages/frontend/core/src/pages/redirect.tsx
+++ b/packages/frontend/core/src/pages/redirect.tsx
@@ -1,3 +1,4 @@
+import { DebugLogger } from '@affine/debug';
 import { type LoaderFunction, Navigate, useLoaderData } from 'react-router-dom';
 
 const trustedDomain = [
@@ -10,6 +11,8 @@ const trustedDomain = [
   'reddit.com',
 ];
 
+const logger = new DebugLogger('redirect_proxy');
+
 export const loader: LoaderFunction = async ({ request }) => {
   const url = new URL(request.url);
   const searchParams = url.searchParams;
@@ -19,14 +22,21 @@ export const loader: LoaderFunction = async ({ request }) => {
     return { allow: false };
   }
 
-  const target = new URL(redirectUri);
+  try {
+    const target = new URL(redirectUri);
 
-  if (
-    trustedDomain.some(domain =>
-      new RegExp(`.?${domain}$`).test(target.hostname)
-    )
-  ) {
-    location.href = redirectUri;
+    if (
+      target.hostname === window.location.hostname ||
+      trustedDomain.some(domain =>
+        new RegExp(`.?${domain}$`).test(target.hostname)
+      )
+    ) {
+      location.href = redirectUri;
+      return { allow: true };
+    }
+  } catch (e) {
+    logger.error('Failed to parse redirect uri', e);
+    return { allow: false };
   }
 
   return { allow: true };
diff --git a/packages/frontend/core/src/utils/popup.ts b/packages/frontend/core/src/utils/popup.ts
index 311863b34..396dc9583 100644
--- a/packages/frontend/core/src/utils/popup.ts
+++ b/packages/frontend/core/src/utils/popup.ts
@@ -1,5 +1,8 @@
 export function popupWindow(target: string) {
   const url = new URL(runtimeConfig.serverUrlPrefix + '/redirect-proxy');
+  target = /^https?:\/\//.test(target)
+    ? target
+    : runtimeConfig.serverUrlPrefix + target;
   url.searchParams.set('redirect_uri', target);
 
   return window.open(url, '_blank', `noreferrer noopener`);