fix(@W-23807280@): normalize projectLoginUrl in getLoginUrl

README.md

@@ -107,7 +107,7 @@ EXAMPLES
     $ sf org list auth
 ```
 
-_See code: [src/commands/org/list/auth.ts](https://github.com/salesforcecli/plugin-auth/blob/5.0.5/src/commands/org/list/auth.ts)_
+_See code: [src/commands/org/list/auth.ts](https://github.com/salesforcecli/plugin-auth/blob/5.0.6-qa.0/src/commands/org/list/auth.ts)_
 
 ## `sf org login access-token`
 
@@ -164,7 +164,7 @@ FLAG DESCRIPTIONS
     To specify a sandbox, set --instance-url to "https://<MyDomainName>--<SandboxName>.sandbox.my.salesforce.com".
 ```
 
-_See code: [src/commands/org/login/access-token.ts](https://github.com/salesforcecli/plugin-auth/blob/5.0.5/src/commands/org/login/access-token.ts)_
+_See code: [src/commands/org/login/access-token.ts](https://github.com/salesforcecli/plugin-auth/blob/5.0.6-qa.0/src/commands/org/login/access-token.ts)_
 
 ## `sf org login jwt`
 
@@ -255,7 +255,7 @@ FLAG DESCRIPTIONS
     To specify a sandbox, set --instance-url to "https://<MyDomainName>--<SandboxName>.sandbox.my.salesforce.com".
 ```
 
-_See code: [src/commands/org/login/jwt.ts](https://github.com/salesforcecli/plugin-auth/blob/5.0.5/src/commands/org/login/jwt.ts)_
+_See code: [src/commands/org/login/jwt.ts](https://github.com/salesforcecli/plugin-auth/blob/5.0.6-qa.0/src/commands/org/login/jwt.ts)_
 
 ## `sf org login sfdx-url`
 
@@ -325,7 +325,7 @@ EXAMPLES
   $ echo url | sf org login sfdx-url --sfdx-url-stdin
 ```
 
-_See code: [src/commands/org/login/sfdx-url.ts](https://github.com/salesforcecli/plugin-auth/blob/5.0.5/src/commands/org/login/sfdx-url.ts)_
+_See code: [src/commands/org/login/sfdx-url.ts](https://github.com/salesforcecli/plugin-auth/blob/5.0.6-qa.0/src/commands/org/login/sfdx-url.ts)_
 
 ## `sf org login web`
 
@@ -430,7 +430,7 @@ FLAG DESCRIPTIONS
     To specify a sandbox, set --instance-url to "https://<MyDomainName>--<SandboxName>.sandbox.my.salesforce.com".
 ```
 
-_See code: [src/commands/org/login/web.ts](https://github.com/salesforcecli/plugin-auth/blob/5.0.5/src/commands/org/login/web.ts)_
+_See code: [src/commands/org/login/web.ts](https://github.com/salesforcecli/plugin-auth/blob/5.0.6-qa.0/src/commands/org/login/web.ts)_
 
 ## `sf org logout`
 
@@ -496,6 +496,6 @@ FLAG DESCRIPTIONS
     All orgs includes Dev Hubs, sandboxes, DE orgs, and expired, deleted, and unknown-status scratch orgs.
 ```
 
-_See code: [src/commands/org/logout.ts](https://github.com/salesforcecli/plugin-auth/blob/5.0.5/src/commands/org/logout.ts)_
+_See code: [src/commands/org/logout.ts](https://github.com/salesforcecli/plugin-auth/blob/5.0.6-qa.0/src/commands/org/logout.ts)_
 
 <!-- commandsstop -->

package.json

@@ -1,7 +1,7 @@
 {
   "name": "@salesforce/plugin-auth",
   "description": "plugin for sf auth commands",
-  "version": "5.0.5",
+  "version": "5.0.6-qa.0",
   "author": "Salesforce",
   "bugs": "https://github.com/forcedotcom/cli/issues",
   "enableO11y": true,
@@ -10,19 +10,19 @@
     "@inquirer/checkbox": "^2.5.0",
     "@inquirer/select": "^2.5.0",
     "@oclif/core": "^4",
-    "@salesforce/core": "^9.1.2",
+    "@salesforce/core": "^9.1.4",
     "@salesforce/kit": "^4.0.0",
-    "@salesforce/plugin-info": "^4.0.0",
-    "@salesforce/sf-plugins-core": "^13.0.0",
+    "@salesforce/plugin-info": "^4.0.9",
+    "@salesforce/sf-plugins-core": "^13.0.3",
     "@salesforce/ts-types": "^3.0.0",
-    "open": "^10.2.0",
+    "open": "^11.0.0",
     "which": "^4"
   },
   "devDependencies": {
     "@oclif/plugin-command-snapshot": "^5.3.20",
-    "@salesforce/cli-plugins-testkit": "^5.3.57",
+    "@salesforce/cli-plugins-testkit": "^5.3.66",
     "@salesforce/dev-scripts": "^11.0.4",
-    "@salesforce/plugin-command-reference": "^3.1.101",
+    "@salesforce/plugin-command-reference": "^3.1.132",
     "@salesforce/ts-sinon": "^1.4.34",
     "@types/which": "^3",
     "eslint-plugin-sf-plugin": "^1.20.33",

src/common.ts

@@ -35,7 +35,8 @@ const getLoginUrl = async (logger: Logger): Promise<string> => {
   try {
     const project = await SfProject.resolve();
     const projectJson = await project.resolveProjectConfig();
-    return getString(projectJson, 'sfdcLoginUrl', SfdcUrl.PRODUCTION);
+    const projectLoginUrl = getString(projectJson, 'sfdcLoginUrl');
+    return projectLoginUrl ? new URL(projectLoginUrl).href : SfdcUrl.PRODUCTION;
   } catch (err) {
     const message: string = (isObject(err) ? Reflect.get(err, 'message') ?? err : err) as string;
     logger.debug(`error occurred while trying to determine loginUrl: ${message}`);

test/common.test.ts

@@ -56,7 +56,7 @@ describe('common unit tests', () => {
         sourceApiVersion: '50.0',
       });
       const loginUrl = await common.resolveLoginUrl(undefined);
-      expect(loginUrl).to.equal(SfdcUrl.PRODUCTION);
+      expect(loginUrl).to.equal(`${SfdcUrl.PRODUCTION}/`);
     });
     it('should return production URL if project with property sfdcLoginUrl present', async () => {
       await projectSetup($$, true, {
@@ -70,7 +70,7 @@ describe('common unit tests', () => {
         sourceApiVersion: '50.0',
       });
       const loginUrl = await common.resolveLoginUrl(undefined);
-      expect(loginUrl).to.equal(SfdcUrl.PRODUCTION);
+      expect(loginUrl).to.equal(`${SfdcUrl.PRODUCTION}/`);
     });
     it('should throw on lightning login URL in sfdcLoginUrl property', async () => {
       await projectSetup($$, true, {
@@ -119,6 +119,29 @@ describe('common unit tests', () => {
       }
     });
   });
+  describe('sfdcLoginUrl normalization', () => {
+    const stubProjectLoginUrl = (sfdcLoginUrl: string): void => {
+      $$.inProject(true);
+      $$.SANDBOXES.PROJECT.stub(SfProject.prototype, 'resolveProjectConfig').resolves({
+        packageDirectories: [{ path: 'force-app', default: true }],
+        sfdcLoginUrl,
+        sourceApiVersion: '50.0',
+      });
+    };
+
+    it('should percent-encode a double-quote in a project sfdcLoginUrl', async () => {
+      stubProjectLoginUrl('https://evil.com/"; calc; "');
+      const loginUrl = await common.resolveLoginUrl(undefined);
+      expect(loginUrl).to.not.include('"');
+      expect(loginUrl).to.equal('https://evil.com/%22;%20calc;%20%22');
+    });
+    it('should fall back to production URL when the project sfdcLoginUrl is malformed', async () => {
+      stubProjectLoginUrl('https://evil.com"; calc; "');
+      const loginUrl = await common.resolveLoginUrl(undefined);
+      expect(loginUrl).to.equal(SfdcUrl.PRODUCTION);
+    });
+  });
+
   describe('custom login url', () => {
     const INSTANCE_URL_1 = 'https://example.com';
     const INSTANCE_URL_2 = 'https://some.other.com';
@@ -151,7 +174,7 @@ describe('common unit tests', () => {
         sourceApiVersion: '50.0',
       });
       const loginUrl = await common.resolveLoginUrl(undefined);
-      expect(loginUrl).to.equal(INSTANCE_URL_2);
+      expect(loginUrl).to.equal(`${INSTANCE_URL_2}/`);
     });
     it('should return custom login URL 1 if project with property sfdcLoginUrl equal to custom url 2', async () => {
       await projectSetup($$, true, {