Ophir LOJKINE d8cb2526de fix(oidc): reject backslash and control chars in relative redirect targets (#1311) ...

The relative-redirect check accepted /\evil.test (and /<TAB>/evil.test):
the WHATWG URL parser used by the url crate treats \ as / and strips ASCII
tab/newline/CR, so url::Url::join turned these into the external authority
evil.test when building post_logout_redirect_uri. is_safe_relative_redirect now
rejects any backslash or ASCII control character, applied via one shared helper
in verify_logout_params, validate_redirect_url, and sqlpage.oidc_logout_url.

2026-06-11 23:30:49 +02:00

..

cli

…

webserver

fix(oidc): reject backslash and control chars in relative redirect targets (#1311)

2026-06-11 23:30:49 +02:00

app_config.rs

Fix Rust 1.95 CI warnings

2026-05-16 00:43:04 +02:00

default_404.sql

…

dynamic_component.rs

…

file_cache.rs

fix: enforce unprivileged path guard on fresh cache hits (#1307)

2026-06-10 16:37:20 +02:00

filesystem.rs

fix: enforce unprivileged path guard on fresh cache hits (#1307)

2026-06-10 16:37:20 +02:00

index.sql

…

lib.rs

…

main.rs

…

render.rs

fix: hide SQL details in production error responses for every output format (#1308)

2026-06-11 11:56:23 +02:00

telemetry_metrics.rs

…

telemetry.rs

Update OpenTelemetry dependencies

2026-05-29 22:24:53 +02:00

template_helpers.rs

…

templates.rs

…

utils.rs

…