From ba5484e991e266b862f156ff334b5e538c808407 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Sun, 23 Aug 2026 09:04:01 +0000
Subject: [PATCH] bug: prevent open redirect from user-controlled redirectPage
 (SonarQube jssecurity:S5146)

Co-Authored-By: Joao Esteves <joao.esteves@cognition.ai>
---
 routes/index.js | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/routes/index.js b/routes/index.js
index 6b5455f03e4..8027864a410 100644
--- a/routes/index.js
+++ b/routes/index.js
@@ -51,17 +51,22 @@ exports.loginHandler = function (req, res, next) {
   }
 };
 
+const ALLOWED_REDIRECT_PATHS = ['/', '/admin', '/account_details', '/login']
+
+function safeRedirectPath(redirectPage) {
+  if (typeof redirectPage !== 'string') {
+    return '/admin'
+  }
+  return ALLOWED_REDIRECT_PATHS.indexOf(redirectPage) !== -1 ? redirectPage : '/admin'
+}
+
 function adminLoginSuccess(redirectPage, session, username, res) {
   session.loggedIn = 1
 
   // Log the login action for audit
   console.log(`User logged in: ${username}`)
 
-  if (redirectPage) {
-      return res.redirect(redirectPage)
-  } else {
-      return res.redirect('/admin')
-  }
+  return res.redirect(safeRedirectPath(redirectPage))
 }
 
 exports.login = function (req, res, next) {