fix(security): prevent open redirect from user-controlled data (SonarQube jssecurity:S5146)

[devin-ai-integration]

Summary

adminLoginSuccess in routes/index.js redirected straight to redirectPage, which comes from req.body.redirectPage on the admin login POST. An attacker could send a victim to /login?redirectPage=https://evil.[REDACTED SECRET] (or //evil.[REDACTED SECRET]) and have the app bounce them off-site after login — a classic open redirect used for phishing/credential harvesting.

Fix restricts the target to same-origin relative paths only, falling back to /admin:

function isSafeRedirectPath(redirectPage) {
  return typeof redirectPage === 'string' &&
    /^\/[^/\\]/.test(redirectPage) &&
    !redirectPage.includes('\\')
}
// if (redirectPage)            -> res.redirect(redirectPage)
// if (isSafeRedirectPath(...)) -> res.redirect(redirectPage) else res.redirect('/admin')

This rejects absolute URLs (https://evil.[REDACTED SECRET]), protocol-relative URLs (//evil.[REDACTED SECRET]) and backslash variants (/\evil.[REDACTED SECRET]) that some browsers normalize to a host.

SonarQube issue: AZhSVLrd4wErqc9Ey1Y4 — rule jssecurity:S5146, routes/index.js:61, severity BLOCKER. No other code was touched.

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/b20590b053fc45e69fc0f66ee592c206
Requested by: @joao-cognition

---

Note

Devin errored when opening this Pull Request as joao-cognition.
As a fallback, Devin opened this PR as itself.

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

SonarQube remediation — issue AZhSVLrd4wErqc9Ey1Y4, rule jssecurity:S5146 (BLOCKER)

What was vulnerable: routes/index.js:61, inside adminLoginSuccess(), called res.redirect(redirectPage) where redirectPage originates from req.body.redirectPage (admin login POST, echoed from req.query.redirectPage in the login view). Any user-controlled absolute URL was accepted, so the app could be used to bounce an authenticated victim to an attacker-controlled host (open redirect → phishing).

What changed: added isSafeRedirectPath() and gated the redirect on it. Only same-origin relative paths (starting with a single / and containing no backslash) are followed; anything else — absolute URLs (https://evil.[REDACTED SECRET]), protocol-relative URLs (//evil.[REDACTED SECRET]), backslash variants (/\evil.[REDACTED SECRET]), and non-string values — falls back to the default /admin.

Scope: one file, +9/−1. No refactoring, reformatting, or other vulnerability fixes; the SonarQube issue status was not modified.