Tom Moor d4dec42bc5 fix: Validate host parameter stored in OAuth state on failure redirect (#11956) ...

* fix: Validate host parameter stored in OAuth state on auth failure path

* fix: Validate OAuth state host to prevent open redirect

Sanitize the host parameter from OAuth state before using it in error
redirects. Adds userinfo stripping to parseDomain's normalizeUrl to
prevent bypasses like "subdomain.base@evil.com", validates custom
domains against registered teams, and introduces Team.findByDomain
with input normalization for consistent domain lookups.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

2026-04-04 16:13:54 -04:00

..

__mocks__

Refactor: Extract Redis cache key generation to RedisPrefixHelper (#11376)

2026-02-09 14:03:02 -05:00

decorators

chore: Remove suppressImplicitAnyIndexErrors TS rule (#7760)

2024-10-11 12:46:46 -07:00

oauth

chore: Update node style imports (#11277)

2026-01-26 20:51:50 -05:00

args.ts

chore: Add flag to prevent automatic migration running on startup

2024-02-20 21:16:58 -05:00

authentication.ts

chore: Update node style imports (#11277)

2026-01-26 20:51:50 -05:00

BaseIssueProvider.ts

chore: Enforce type import consistency (#10968)

2025-12-19 23:07:02 -05:00

BaseSearchProvider.ts

feat: Extract search into pluggable provider system (#11448)

2026-03-25 23:01:26 -04:00

CacheHelper.ts

chore: Address code quality findings (#11960)

2026-04-04 16:11:10 -04:00

crypto.ts

chore: Update node style imports (#11277)

2026-01-26 20:51:50 -05:00

csrf.ts

chore: Update node style imports (#11277)

2026-01-26 20:51:50 -05:00

DocumentConverter.test.ts

fix: Unable to resize imported image from docx (#11878)

2026-03-27 08:42:24 -04:00

DocumentConverter.ts

fix: Unable to resize imported image from docx (#11878)

2026-03-27 08:42:24 -04:00

embeds.test.ts

fix: Do not show embed option for unembeddable links (#11323)

2026-01-31 13:57:25 -05:00

embeds.ts

fix: Do not show embed option for unembeddable links (#11323)

2026-01-31 13:57:25 -05:00

environment.test.ts

feat: Add support for Docker Swarm style secrets (#11906)

2026-03-30 19:42:20 -04:00

environment.ts

feat: Add support for Docker Swarm style secrets (#11906)

2026-03-30 19:42:20 -04:00

fetch.ts

fix: Webhook held in memory after timeout (#11580)

2026-02-26 08:52:40 -05:00

fs.test.ts

fix: Various issues with JSON import and UTF8 or very long filenames (#9850)

2025-08-05 21:15:45 -04:00

fs.ts

chore: Update node style imports (#11277)

2026-01-26 20:51:50 -05:00

getInstallationInfo.test.ts

Handle network failures in installation.info endpoint for isolated environments (#11546)

2026-02-24 15:20:48 -05:00

getInstallationInfo.ts

Handle network failures in installation.info endpoint for isolated environments (#11546)

2026-02-24 15:20:48 -05:00

GroupSyncProvider.ts

Group sync framework (#11684)

2026-03-14 23:02:20 -04:00

i18n.ts

chore: Update node style imports (#11277)

2026-01-26 20:51:50 -05:00

ImportHelper.test.ts

chore: Update node style imports (#11277)

2026-01-26 20:51:50 -05:00

ImportHelper.ts

chore: Update node style imports (#11277)

2026-01-26 20:51:50 -05:00

indexing.test.ts

fix: collectionIndexing results in teamId undefined error due to Sequelize bug (#8918)

2025-04-09 07:12:48 -07:00

indexing.ts

chore: Enforce type import consistency (#10968)

2025-12-19 23:07:02 -05:00

jwt.ts

chore: Store service in JWT (#11136)

2026-01-10 12:28:00 -05:00

koa.ts

chore: Enforce type import consistency (#10968)

2025-12-19 23:07:02 -05:00

MutexLock.ts

perf: Protect against ValidateSSOAccessTask thundering herd (#11532)

2026-02-23 21:05:01 -05:00

oauth.test.ts

Move Document event writing to model layer (#9790)

2025-11-23 20:40:45 +01:00

oauth.ts

fix: Incorrect handling of missing refresh token (#10886)

2025-12-13 12:37:06 -05:00

opensearch.ts

Return cache headers on opensearch.xml response

2024-02-21 07:35:38 -05:00

parseAttachmentIds.test.ts

chore: Update node style imports (#11277)

2026-01-26 20:51:50 -05:00

parseAttachmentIds.ts

JSON to client (#5553)

2024-05-24 05:29:00 -07:00

parseImages.test.ts

fix: Handle base64 and remote images when creating a file (#5740)

2023-08-26 06:15:14 -07:00

parseImages.ts

chore: Enforce type import consistency (#10968)

2025-12-19 23:07:02 -05:00

passport.ts

fix: Validate host parameter stored in OAuth state on failure redirect (#11956)

2026-04-04 16:13:54 -04:00

permissions.test.ts

Prevent duplicate emails when user has existing access to a document. (#8263)

2025-03-04 17:56:44 -08:00

permissions.ts

chore: Enforce type import consistency (#10968)

2025-12-19 23:07:02 -05:00

PluginManager.ts

feat: Extract search into pluggable provider system (#11448)

2026-03-25 23:01:26 -04:00

prefetchTags.tsx

chore: Enforce type import consistency (#10968)

2025-12-19 23:07:02 -05:00

ProsemirrorHelper.test.ts

fix: Correctly strip node comments on duplication (#11700)

2026-03-10 19:25:04 -04:00

RateLimiter.ts

chore: Enforce type import consistency (#10968)

2025-12-19 23:07:02 -05:00

readManifestFile.ts

chore: Update node style imports (#11277)

2026-01-26 20:51:50 -05:00

RedisPrefixHelper.test.ts

Refactor: Extract Redis cache key generation to RedisPrefixHelper (#11376)

2026-02-09 14:03:02 -05:00

RedisPrefixHelper.ts

perf: Hold 10s cache on user.collectionIds (#11579)

2026-02-26 08:15:35 -05:00

removeIndexCollision.test.ts

Add locking to collection.move mutation

2024-07-23 22:13:56 -04:00

removeIndexCollision.ts

fix: Replacement parameters in index collision query (#10880)

2025-12-12 23:03:59 -05:00

robots.ts

chore: Remove DEPLOYMENT and SUBDOMAINS_ENABLED (#5742)

2023-08-28 17:39:58 -07:00

SearchProviderManager.ts

feat: Extract search into pluggable provider system (#11448)

2026-03-25 23:01:26 -04:00

ShutdownHelper.ts

fix: Shutdown during migrations does not release mutex lock (#10879)

2025-12-12 22:20:53 -05:00

sitemap.ts

chore: Enforce type import consistency (#10968)

2025-12-19 23:07:02 -05:00

ssl.ts

chore: Update node style imports (#11277)

2026-01-26 20:51:50 -05:00

startup.ts

fix: Shutdown during migrations does not release mutex lock (#10879)

2025-12-12 22:20:53 -05:00

updates.ts

chore: Update node style imports (#11277)

2026-01-26 20:51:50 -05:00

url.test.ts

feat: GitLab integration (#10861)

2026-02-21 17:52:27 -05:00

url.ts

feat: GitLab integration (#10861)

2026-02-21 17:52:27 -05:00

validators.test.ts

fix: Support mailbox format for SMTP_FROM_EMAIL and SMTP_REPLY_EMAIL (#11784)

2026-03-16 22:48:56 -04:00

validators.ts

fix: Support mailbox format for SMTP_FROM_EMAIL and SMTP_REPLY_EMAIL (#11784)

2026-03-16 22:48:56 -04:00

VerificationCode.test.ts

Add limit of 10 attempts for OTP login (#11623)

2026-03-02 18:41:03 -05:00

VerificationCode.ts

Add limit of 10 attempts for OTP login (#11623)

2026-03-02 18:41:03 -05:00

ZipHelper.ts

chore: Update node style imports (#11277)

2026-01-26 20:51:50 -05:00

zod.ts

chore: Upgrade Zod to version 4 (#11465)

2026-02-15 22:54:50 -05:00