safe-next.ts

/** Where to land when the `next` parameter is missing or refuses to be trusted. */
export const DEFAULT_NEXT = '/portfolio'

/**
 * Narrows a `?next=` parameter to somewhere inside this app.
 *
 * The value arrives in a URL anyone can write and hand to someone else, and it
 * ends up in `router.replace`. Next.js will navigate to a `javascript:` URL
 * given one, so an unchecked value is script execution on our origin, not just
 * an open redirect.
 *
 * The rule is narrow on purpose: a single leading slash, then a path. That
 * rejects every scheme without having to enumerate them, and it rejects the
 * two spellings of "protocol-relative" —  `//evil.example`, and `/\evil.example`
 * which several browsers normalise to the same thing.
 *
 * Anything else silently becomes the default. There is no legitimate way to
 * arrive here with an off-site destination, so there is nothing to explain.
 */
export function safeNext(raw: string | null | undefined, fallback = DEFAULT_NEXT): string {
  if (!raw) return fallback

  // A tab or newline inside the value can split it past a naive check, and no
  // real path contains one.
  if (/[-\s]/.test(raw)) return fallback

  if (raw[0] !== '/') return fallback
  if (raw[1] === '/' || raw[1] === '\\') return fallback

  return raw
}