fix: support query params in login redirects (#910)

frontend/src/component/common/ProtectedRoute/ProtectedRoute.jsx

@@ -6,9 +6,10 @@ const ProtectedRoute = ({
     renderProps = {},
     ...rest
 }) => {
-    const { pathname } = useLocation();
-    const loginLink =
-        pathname.length > 1 ? `/login?redirect=${pathname}` : '/login';
+    const { pathname, search } = useLocation();
+    const redirect = encodeURIComponent(pathname + search);
+    const loginLink = `/login?redirect=${redirect}`;
+
     return (
         <Route
             {...rest}

frontend/src/component/user/Login/Login.tsx

@@ -8,6 +8,7 @@ import Authentication from '../Authentication/Authentication';
 import { useAuthDetails } from 'hooks/api/getters/useAuth/useAuthDetails';
 import { useAuthUser } from 'hooks/api/getters/useAuth/useAuthUser';
 import { Redirect } from 'react-router-dom';
+import { parseRedirectParam } from 'component/user/Login/parseRedirectParam';
 
 const Login = () => {
     const styles = useStyles();
@@ -18,7 +19,7 @@ const Login = () => {
     const redirect = query.get('redirect') || '/';
 
     if (user) {
-        return <Redirect to={redirect} />;
+        return <Redirect to={parseRedirectParam(redirect)} />;
     }
 
     return (

frontend/src/component/user/Login/parseRedirectParam.test.ts

@@ -0,0 +1,33 @@
+import { parseRedirectParam } from 'component/user/Login/parseRedirectParam';
+
+test('parseRedirectParam should parse an empty redirect param', async () => {
+    expect(parseRedirectParam('')).toEqual({
+        pathname: '/',
+        search: '',
+    });
+});
+
+test('parseRedirectParam should parse the pathname', async () => {
+    expect(parseRedirectParam(encodeURIComponent('/foo'))).toEqual({
+        pathname: '/foo',
+        search: '',
+    });
+});
+
+test('parseRedirectParam should parse the search query', async () => {
+    expect(parseRedirectParam(encodeURIComponent('/foo?a=1&b=2'))).toEqual({
+        pathname: '/foo',
+        search: '?a=1&b=2',
+    });
+});
+
+test('parseRedirectParam should ignore external domains', async () => {
+    expect(
+        parseRedirectParam(
+            encodeURIComponent('https://example.com/foo?a=1&b=2')
+        )
+    ).toEqual({
+        pathname: '/foo',
+        search: '?a=1&b=2',
+    });
+});

frontend/src/component/user/Login/parseRedirectParam.ts

@@ -0,0 +1,16 @@
+interface IRedirectParam {
+    pathname: string;
+    search: string;
+}
+
+export const parseRedirectParam = (redirect: string): IRedirectParam => {
+    const url = new URL(
+        decodeURIComponent(redirect),
+        window.location.protocol + '//' + window.location.host
+    );
+
+    return {
+        pathname: url.pathname,
+        search: url.search,
+    };
+};