Merge branch 'devin/BUS-1455-1752897143' of https://github.com/buster-so/buster into devin/BUS-1455-1752897143

apps/web/src/app/app/layout.tsx

@@ -10,6 +10,15 @@ import { createBusterRoute } from '@/routes';
 import { BusterRoutes } from '@/routes/busterRoutes';
 import { ClientRedirect } from '../../components/ui/layouts/ClientRedirect';
 
+const isValidRedirectUrl = (url: string): boolean => {
+  try {
+    const decoded = decodeURIComponent(url);
+    return decoded.startsWith('/') && !decoded.startsWith('//');
+  } catch {
+    return false;
+  }
+};
+
 const newUserRoute = createBusterRoute({ route: BusterRoutes.NEW_USER });
 const loginRoute = createBusterRoute({ route: BusterRoutes.AUTH_LOGIN });
 
@@ -40,7 +49,7 @@ export default async function Layout({
     (supabaseContext.user?.is_anonymous && pathname !== loginRoute) ||
     !supabaseContext?.user?.id
   ) {
-    const redirectParam = pathname ? encodeURIComponent(pathname) : '';
+    const redirectParam = pathname && isValidRedirectUrl(pathname) ? encodeURIComponent(pathname) : '';
     const loginUrlWithRedirect = redirectParam ? `${loginRoute}?next=${redirectParam}` : loginRoute;
     return <ClientRedirect to={loginUrlWithRedirect} />;
   }

apps/web/src/app/auth/login/page.tsx

@@ -1,5 +1,12 @@
 import { LoginForm } from '@/components/features/auth/LoginForm';
 
-export default function Login() {
+export default async function Login({ 
-  return <LoginForm />;
+  searchParams 
+}: { 
+  searchParams: Promise<{ [key: string]: string | string[] | undefined }> 
+}) {
+  const params = await searchParams;
+  const redirectTo = typeof params.next === 'string' ? params.next : null;
+  
+  return <LoginForm redirectTo={redirectTo} />;
 }

apps/web/src/components/features/auth/LoginForm.tsx

@@ -2,7 +2,6 @@
 
 import Cookies from 'js-cookie';
 import Link from 'next/link';
-import { useSearchParams } from 'next/navigation';
 import React, { useMemo, useState } from 'react';
 import { useHotkeys } from 'react-hotkeys-hook';
 import { Button } from '@/components/ui/buttons';
@@ -31,9 +30,7 @@ const DEFAULT_CREDENTIALS = {
   password: process.env.NEXT_PUBLIC_USER_PASSWORD || ''
 };
 
-export const LoginForm: React.FC = () => {
+export const LoginForm: React.FC<{ redirectTo?: string | null }> = ({ redirectTo }) => {
-  const searchParams = useSearchParams();
-  const redirectTo = searchParams.get('next');
   const [loading, setLoading] = useState<'google' | 'github' | 'azure' | 'email' | null>(null);
   const [errorMessages, setErrorMessages] = useState<string[]>([]);
   const [signUpFlow, setSignUpFlow] = useState(true);