Skip to content

fix: onboarding redirection loop and bug fixes - #3250

Merged
sriramveeraghanta merged 4 commits into
developfrom
fix/onboarding_redirection
Dec 28, 2023
Merged

fix: onboarding redirection loop and bug fixes#3250
sriramveeraghanta merged 4 commits into
developfrom
fix/onboarding_redirection

Conversation

@anmolsinghbhatia

@anmolsinghbhatia anmolsinghbhatia commented Dec 26, 2023

Copy link
Copy Markdown
Contributor

Problem:

  • Experiencing a redirection loop problem while signing up with a new email. To replicate:
    • Sign up using a new email address.
    • Enter a unique code as prompted.
    • Proceed to the "Set Up Workspace" feature.
  • The copy issue link is malfunctioning.
  • Inconsistent use of "next_url" and "next_path" in various locations.
  • Lack of validation for the "next_path" URL poses a significant security vulnerability.

Resolution:

  • Removed unnecessary hooks from the onboarding page, potentially eliminating the infinite loop & Implemented a try-catch block in the 'handleSignInRedirection' function for additional error handling.
  • Rectify the copy issue link by removing the extra slash at the beginning.
  • Ensure consistency by standardizing all references to "next_path."
  • Implement validation for "next_path" redirection to prevent potential Client-side cross-site scripting vulnerabilities.

These issues are associated with following:

Comment thread web/hooks/use-sign-in-redirection.ts Fixed
Comment thread web/hooks/use-sign-in-redirection.ts Fixed
// if next_path is provided, redirect the user to that url
if (next_path) {
if (isValidURL(next_path.toString())) {
router.push(next_path.toString());

Check warning

Code scanning / CodeQL

Client-side URL redirect

Untrusted URL redirection depends on a [user-provided value](1).
else handleUserRouteAuthentication();
if (next_path) {
if (isValidURL(next_path.toString())) {
router.push(next_path.toString());

Check warning

Code scanning / CodeQL

Client-side URL redirect

Untrusted URL redirection depends on a [user-provided value](1).
// if next_path is provided, redirect the user to that url
if (next_path) {
if (isValidURL(next_path.toString())) {
router.push(next_path.toString());

Check failure

Code scanning / CodeQL

Client-side cross-site scripting

Cross-site scripting vulnerability due to [user-provided value](1).
else handleUserRouteAuthentication();
if (next_path) {
if (isValidURL(next_path.toString())) {
router.push(next_path.toString());

Check failure

Code scanning / CodeQL

Client-side cross-site scripting

Cross-site scripting vulnerability due to [user-provided value](1).
@anmolsinghbhatia anmolsinghbhatia changed the title fix: onboarding redirection fix: onboarding redirection loop and bug fixes Dec 26, 2023
@sriramveeraghanta
sriramveeraghanta merged commit 91e84ae into develop Dec 28, 2023
@sriramveeraghanta
sriramveeraghanta deleted the fix/onboarding_redirection branch December 28, 2023 11:47
sriramveeraghanta pushed a commit that referenced this pull request Jan 22, 2024
* chore: try and catch added in handleSignInRedirection

* chore: remove unnecessary hooks

* fix: handleCopyIssueLink url updated

* chore: swap next_url with next_path and validate redirection logic for next_path url
vamsikrishnamathala pushed a commit that referenced this pull request Aug 7, 2025
DoctorFogarty pushed a commit to DoctorFogarty/plane that referenced this pull request Aug 7, 2026
* chore: try and catch added in handleSignInRedirection

* chore: remove unnecessary hooks

* fix: handleCopyIssueLink url updated

* chore: swap next_url with next_path and validate redirection logic for next_path url
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants