OpenC3 COSMOS vulnerable to cross-site scripting in Login functionality (`GHSL-2024-128`)

@@ -35,9 +35,14 @@ class Auth {
     delete localStorage.openc3Token
   }
   login(redirect) {
+    let url = new URL(redirect)
+    let result = url.pathname
+    if (url.search) {
+      result = result + url.search
+    }
     // redirect to login if we're not already there
     if (!/^\/login/.test(location.pathname))
-      location = `/login?redirect=${encodeURI(redirect)}`
+      location = `/login?redirect=${encodeURI(result)}`
   }
   logout() {
     this.clearTokens()

@@ -145,7 +145,12 @@ export default {
       const redirect = new URLSearchParams(window.location.search).get(
         'redirect',
       )
-      window.location = decodeURI(redirect || '/')
+      if (redirect[0] === '/' && redirect[1] !== '/') {
+        // Valid relative redirect URL
+        window.location = decodeURI(redirect)
+      } else {
+        window.location = '/'
+      }
     },
     verifyPassword: function () {
       this.showAlert = false