[mirotalkbro] - fix open redirect

app/server.js

@@ -222,20 +222,31 @@ app.use((err, req, res, next) => {
             body: req.body,
             error: err.message,
         });
-        return res.status(400).send({ status: 404, message: err.message });
+        return res.status(400).send({ status: 404, message: err.message }); // Bad request
     }
-    if (req.path.substr(-1) === '/' && req.path.length > 1) {
-        let query = req.url.slice(req.path.length);
-        res.redirect(301, req.path.slice(0, -1) + query);
+
+    // Remove multiple leading slashes & normalize path
+    let cleanPath = req.path.replace(/^\/+/, ''); // Removes all leading slashes
+    let query = req.url.slice(req.path.length);
+
+    // Prevent open redirect attacks by checking if the path is an external domain
+    if (/^([a-zA-Z0-9-]+\.)+[a-zA-Z]{2,}/.test(cleanPath)) {
+        return res.status(400).send('Bad Request: Potential Open Redirect Detected');
+    }
+
+    // If a trailing slash exists, redirect to a clean version
+    if (req.path.endsWith('/') && req.path.length > 1) {
+        return res.redirect(301, '/' + cleanPath + query);
     } else {
         log.debug('New request', {
             // headers: req.headers,
             // body: req.body,
             method: req.method,
             path: req.originalUrl,
         });
-        next();
     }
+
+    next();
 });
 
 // OpenID Connect - Dynamically set baseURL based on incoming host and protocol