[PR #5729] fix: prevent open redirect in desktop auth callback (CWE-601) #5330

New issue

Open

opened 2026-03-17 02:47:10 +03:00 by kerem · 0 comments

kerem commented

2026-03-17 02:47:10 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hoppscotch/hoppscotch/pull/5729
Author: @rajnishprecogs
Created: 12/26/2025
Status: 🔄 Open

Base: main ← Head: fix/open-redirect-desktop-callback

📝 Commits (1)

478433e fix: prevent open redirect in desktop auth callback (CWE-601)

📊 Changes

1 file changed (+20 additions, -1 deletions)

View changed files

📝 packages/hoppscotch-backend/src/auth/auth.controller.ts (+20 -1)

📄 Description

Closes #

What's changed

Notes to reviewers

Summary by cubic

Prevents open redirects in the desktop auth callback by parsing redirect_uri and strictly limiting allowed hosts to loopback. Blocks malicious URLs like http://localhost.evil.com.

Bug Fixes
- Use URL parsing instead of a startsWith check.
- Allow only http scheme and hosts: localhost, 127.0.0.1, [::1]; otherwise return 400.

^{Written for commit 478433e10b. Summary will update automatically on new commits.}

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hoppscotch/hoppscotch/pull/5729 **Author:** [@rajnishprecogs](https://github.com/rajnishprecogs) **Created:** 12/26/2025 **Status:** 🔄 Open **Base:** `main` ← **Head:** `fix/open-redirect-desktop-callback` --- ### 📝 Commits (1) - [`478433e`](https://github.com/hoppscotch/hoppscotch/commit/478433e10b4c30c22a81834ac3f9ea1f355865ef) fix: prevent open redirect in desktop auth callback (CWE-601) ### 📊 Changes **1 file changed** (+20 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `packages/hoppscotch-backend/src/auth/auth.controller.ts` (+20 -1) </details> ### 📄 Description   Closes #   ### What's changed   ### Notes to reviewers   --- ## Summary by cubic Prevents open redirects in the desktop auth callback by parsing redirect_uri and strictly limiting allowed hosts to loopback. Blocks malicious URLs like http://localhost.evil.com. - **Bug Fixes** - Use URL parsing instead of a startsWith check. - Allow only http scheme and hosts: localhost, 127.0.0.1, [::1]; otherwise return 400. <sup>Written for commit 478433e10b4c30c22a81834ac3f9ea1f355865ef. Summary will update automatically on new commits.</sup>  --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>