From b7943a7586fbd0bb0e19aad7732c11a62f72d7c1 Mon Sep 17 00:00:00 2001
From: たかし <30774985+takashi000@users.noreply.github.com>
Date: Sat, 27 Jun 2026 11:30:25 +0900
Subject: Potential fix for code scanning alert no. 1: Client-side URL redirect

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 src/ollama_web/static/login.js | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'src/ollama_web/static')

diff --git a/src/ollama_web/static/login.js b/src/ollama_web/static/login.js
index 648e219..1f91868 100644
--- a/src/ollama_web/static/login.js
+++ b/src/ollama_web/static/login.js
@@ -3,6 +3,7 @@
 const form = document.getElementById("login-form");
 const pinInput = document.getElementById("pin-input");
 const errorEl = document.getElementById("login-error");
+const ALLOWED_NEXT_PATHS = new Set(["/", "/chat", "/settings"]);
 
 form.addEventListener("submit", async (event) => {
   event.preventDefault();
@@ -16,6 +17,7 @@ form.addEventListener("submit", async (event) => {
     errorEl.textContent = "PINが違います";
     return;
   }
-  const next = new URLSearchParams(window.location.search).get("next") || "/";
-  window.location.assign(next.startsWith("/") ? next : "/");
+  const requestedNext = new URLSearchParams(window.location.search).get("next") || "/";
+  const safeNext = ALLOWED_NEXT_PATHS.has(requestedNext) ? requestedNext : "/";
+  window.location.assign(safeNext);
 });
-- 
cgit v1.2.3