Merge pull request #20409 from mozilla/pay-3653-invalid-url

StaberindeZA · web-flow · commit 3d5c15bc4437 · 2026-04-21T12:26:32.000-04:00
fix(payments): full relative paths for Next.js 15 redirects
diff --git a/apps/payments/next/app/[locale]/[offeringId]/[interval]/checkout/[cartId]/error/page.tsx b/apps/payments/next/app/[locale]/[offeringId]/[interval]/checkout/[cartId]/error/page.tsx
@@ -58,9 +58,11 @@ export default async function CheckoutError({
   const acceptLanguage = (await headers()).get('accept-language');
 
   const sessionPromise = auth();
+  const currentPathname = `/${resolvedParams.locale}/${resolvedParams.offeringId}/${resolvedParams.interval}/checkout/${resolvedParams.cartId}/error`;
   const cartPromise = getCartOrRedirectAction(
     resolvedParams.cartId,
     SupportedPages.ERROR,
+    currentPathname,
     resolvedSearchParams
   );
   const l10n = getApp().getL10n(acceptLanguage, locale);
@@ -135,4 +137,4 @@ export default async function CheckoutError({
       </section>
     </>
   );
-}
+}
diff --git a/apps/payments/next/app/[locale]/[offeringId]/[interval]/checkout/[cartId]/needs_input/page.tsx b/apps/payments/next/app/[locale]/[offeringId]/[interval]/checkout/[cartId]/needs_input/page.tsx
@@ -54,9 +54,11 @@ export default async function NeedsInputPage({
   const l10n = getApp().getL10n(acceptLanguage, locale);
 
   const sessionPromise = auth();
+  const currentPathname = `/${resolvedParams.locale}/${resolvedParams.offeringId}/${resolvedParams.interval}/checkout/${resolvedParams.cartId}/needs_input`;
   const cartPromise = getCartOrRedirectAction(
     resolvedParams.cartId,
     SupportedPages.NEEDS_INPUT,
+    currentPathname,
     resolvedSearchParams
   );
   const [session, cart] = await Promise.all([sessionPromise, cartPromise]);
@@ -107,4 +109,4 @@ export default async function NeedsInputPage({
       </h2>
     </section>
   );
-}
+}
diff --git a/apps/payments/next/app/[locale]/[offeringId]/[interval]/checkout/[cartId]/processing/page.tsx b/apps/payments/next/app/[locale]/[offeringId]/[interval]/checkout/[cartId]/processing/page.tsx
@@ -48,9 +48,11 @@ export default async function ProcessingPage({
   const { locale } = resolvedParams;
   const acceptLanguage = (await headers()).get('accept-language');
   const l10n = getApp().getL10n(acceptLanguage, locale);
+  const currentPathname = `/${resolvedParams.locale}/${resolvedParams.offeringId}/${resolvedParams.interval}/checkout/${resolvedParams.cartId}/processing`;
   await validateCartStateAndRedirectAction(
     resolvedParams.cartId,
     SupportedPages.PROCESSING,
+    currentPathname,
     resolvedSearchParams
   );
   return (
@@ -69,4 +71,4 @@ export default async function ProcessingPage({
       </h2>
     </section>
   );
-}
+}
diff --git a/apps/payments/next/app/[locale]/[offeringId]/[interval]/checkout/[cartId]/start/page.tsx b/apps/payments/next/app/[locale]/[offeringId]/[interval]/checkout/[cartId]/start/page.tsx
@@ -72,9 +72,11 @@ export default async function Checkout({
     acceptLanguage,
     locale
   );
+  const currentPathname = `/${resolvedParams.locale}/${resolvedParams.offeringId}/${resolvedParams.interval}/checkout/${resolvedParams.cartId}/start`;
   const cartPromise = getCartOrRedirectAction(
     resolvedParams.cartId,
     SupportedPages.START,
+    currentPathname,
     resolvedSearchParams
   );
   //TODO - Replace with cartPromise as part of FXA-8903
@@ -298,4 +300,4 @@ export default async function Checkout({
       </section>
     </>
   );
-}
+}
diff --git a/apps/payments/next/app/[locale]/[offeringId]/[interval]/checkout/[cartId]/success/page.tsx b/apps/payments/next/app/[locale]/[offeringId]/[interval]/checkout/[cartId]/success/page.tsx
@@ -60,9 +60,11 @@ export default async function CheckoutSuccess({
     acceptLanguage,
     locale
   );
+  const currentPathname = `/${resolvedParams.locale}/${resolvedParams.offeringId}/${resolvedParams.interval}/checkout/${resolvedParams.cartId}/success`;
   const cartDataPromise = getCartOrRedirectAction(
     resolvedParams.cartId,
     SupportedPages.SUCCESS,
+    currentPathname,
     resolvedSearchParams
   );
   const sessionPromise = auth();
@@ -217,4 +219,4 @@ export default async function CheckoutSuccess({
       </a>
     </section>
   );
-}
+}
diff --git a/apps/payments/next/app/[locale]/[offeringId]/[interval]/upgrade/[cartId]/(mainLayout)/error/page.tsx b/apps/payments/next/app/[locale]/[offeringId]/[interval]/upgrade/[cartId]/(mainLayout)/error/page.tsx
@@ -56,9 +56,11 @@ export default async function UpgradeError({
   const acceptLanguage = (await headers()).get('accept-language');
 
   const sessionPromise = auth();
+  const currentPathname = `/${resolvedParams.locale}/${resolvedParams.offeringId}/${resolvedParams.interval}/upgrade/${resolvedParams.cartId}/error`;
   const cartPromise = getCartOrRedirectAction(
     resolvedParams.cartId,
     SupportedPages.ERROR,
+    currentPathname,
     resolvedSearchParams
   );
   const l10n = getApp().getL10n(acceptLanguage, locale);
@@ -131,4 +133,4 @@ export default async function UpgradeError({
       </section>
     </>
   );
-}
+}
diff --git a/apps/payments/next/app/[locale]/[offeringId]/[interval]/upgrade/[cartId]/(mainLayout)/needs_input/page.tsx b/apps/payments/next/app/[locale]/[offeringId]/[interval]/upgrade/[cartId]/(mainLayout)/needs_input/page.tsx
@@ -52,9 +52,11 @@ export default async function NeedsInputPage({
   const { locale } = resolvedParams;
   const acceptLanguage = (await headers()).get('accept-language');
   const l10n = getApp().getL10n(acceptLanguage, locale);
+  const currentPathname = `/${resolvedParams.locale}/${resolvedParams.offeringId}/${resolvedParams.interval}/upgrade/${resolvedParams.cartId}/needs_input`;
   const cartPromise = getCartOrRedirectAction(
     resolvedParams.cartId,
     SupportedPages.NEEDS_INPUT,
+    currentPathname,
     resolvedSearchParams
   );
   const sessionPromise = auth();
@@ -105,4 +107,4 @@ export default async function NeedsInputPage({
       </h2>
     </section>
   );
-}
+}
diff --git a/apps/payments/next/app/[locale]/[offeringId]/[interval]/upgrade/[cartId]/(mainLayout)/processing/page.tsx b/apps/payments/next/app/[locale]/[offeringId]/[interval]/upgrade/[cartId]/(mainLayout)/processing/page.tsx
@@ -48,9 +48,11 @@ export default async function ProcessingPage({
   const { locale } = resolvedParams;
   const acceptLanguage = (await headers()).get('accept-language');
   const l10n = getApp().getL10n(acceptLanguage, locale);
+  const currentPathname = `/${resolvedParams.locale}/${resolvedParams.offeringId}/${resolvedParams.interval}/upgrade/${resolvedParams.cartId}/processing`;
   await validateCartStateAndRedirectAction(
     resolvedParams.cartId,
     SupportedPages.PROCESSING,
+    currentPathname,
     resolvedSearchParams
   );
   return (
@@ -69,4 +71,4 @@ export default async function ProcessingPage({
       </h2>
     </section>
   );
-}
+}
diff --git a/apps/payments/next/app/[locale]/[offeringId]/[interval]/upgrade/[cartId]/(mainLayout)/success/page.tsx b/apps/payments/next/app/[locale]/[offeringId]/[interval]/upgrade/[cartId]/(mainLayout)/success/page.tsx
@@ -64,9 +64,11 @@ export default async function UpgradeSuccess({
     acceptLanguage,
     locale
   );
+  const currentPathname = `/${resolvedParams.locale}/${resolvedParams.offeringId}/${resolvedParams.interval}/upgrade/${resolvedParams.cartId}/success`;
   const cartDataPromise = getCartOrRedirectAction(
     resolvedParams.cartId,
     SupportedPages.SUCCESS,
+    currentPathname,
     resolvedSearchParams
   );
   const sessionPromise = auth();
@@ -240,4 +242,4 @@ export default async function UpgradeSuccess({
       </section>
     </>
   );
-}
+}
diff --git a/apps/payments/next/app/[locale]/[offeringId]/[interval]/upgrade/[cartId]/(startLayout)/start/page.tsx b/apps/payments/next/app/[locale]/[offeringId]/[interval]/upgrade/[cartId]/(startLayout)/start/page.tsx
@@ -59,9 +59,11 @@ export default async function Upgrade({
   const l10n = getApp().getL10n(acceptLanguage, locale);
   const session = await auth();
 
+  const currentPathname = `/${resolvedParams.locale}/${resolvedParams.offeringId}/${resolvedParams.interval}/upgrade/${resolvedParams.cartId}/start`;
   const cartDataPromise = getCartOrRedirectAction(
     resolvedParams.cartId,
     SupportedPages.START,
+    currentPathname,
     resolvedSearchParams
   );
   const cmsDataPromise = fetchCMSData(
@@ -206,4 +208,4 @@ export default async function Upgrade({
       </section>
     </>
   );
-}
+}
diff --git a/libs/payments/ui/src/lib/actions/getCartOrRedirect.ts b/libs/payments/ui/src/lib/actions/getCartOrRedirect.ts
@@ -9,6 +9,7 @@ import { getApp } from '../nestapp/app';
 import { getRedirect, validateCartState } from '../utils/get-cart';
 import { SupportedPages } from '../utils/types';
 import { URLSearchParams } from 'url';
+import { sanitizePathname } from '../utils/sanitizePathname';
 import {
   StartCartDTO,
   ProcessingCartDTO,
@@ -22,35 +23,42 @@ import {
  * Get Cart or Redirect if cart state does not match supported page
  * @@param cartId - Cart ID
  * @@param page - Page that action is being called from
+ * @@param currentPathname - Current pathname for constructing redirect URLs
  */
 async function getCartOrRedirectAction(
   cartId: string,
   page: SupportedPages.START,
+  currentPathname: string,
   searchParams?: Record<string, string | string[] | undefined>
 ): Promise<StartCartDTO>;
 async function getCartOrRedirectAction(
   cartId: string,
   page: SupportedPages.PROCESSING,
+  currentPathname: string,
   searchParams?: Record<string, string | string[] | undefined>
 ): Promise<ProcessingCartDTO>;
 async function getCartOrRedirectAction(
   cartId: string,
   page: SupportedPages.NEEDS_INPUT,
+  currentPathname: string,
   searchParams?: Record<string, string | string[] | undefined>
 ): Promise<NeedsInputCartDTO>;
 async function getCartOrRedirectAction(
   cartId: string,
   page: SupportedPages.ERROR,
+  currentPathname: string,
   searchParams?: Record<string, string | string[] | undefined>
 ): Promise<FailCartDTO>;
 async function getCartOrRedirectAction(
   cartId: string,
   page: SupportedPages.SUCCESS,
+  currentPathname: string,
   searchParams?: Record<string, string | string[] | undefined>
 ): Promise<SuccessCartDTO>;
 async function getCartOrRedirectAction(
   cartId: string,
   page: SupportedPages,
+  currentPathname: string,
   searchParams?: Record<string, string | string[] | undefined>
 ): Promise<CartDTO> {
   const filteredParams = searchParams
@@ -63,10 +71,17 @@ async function getCartOrRedirectAction(
   });
 
   if (!validateCartState(cart.state, page)) {
-    redirect(getRedirect(cart.state) + params);
+    // Sanitize pathname to prevent open redirect vulnerabilities
+    const safePath = sanitizePathname(currentPathname);
+    
+    // Replace the last segment with the redirect path to maintain the full path structure
+    const pathSegments = safePath.split('/');
+    pathSegments[pathSegments.length - 1] = getRedirect(cart.state);
+    const redirectPath = pathSegments.join('/');
+    redirect(redirectPath + params);
   }
 
   return cart;
 }
 
-export { getCartOrRedirectAction };
+export { getCartOrRedirectAction };
diff --git a/libs/payments/ui/src/lib/actions/handleStripeError.ts b/libs/payments/ui/src/lib/actions/handleStripeError.ts
@@ -10,20 +10,32 @@ import { redirect } from 'next/navigation';
 import { stripeErrorToErrorReasonId } from '@fxa/payments/cart';
 import { URLSearchParams } from 'url';
 import { flattenRouteParams } from '../utils/flatParam';
+import { sanitizePathname } from '../utils/sanitizePathname';
 
 export const handleStripeErrorAction = async (
   cartId: string,
   stripeError: StripeError,
+  currentPathname: string,
   searchParams?: Record<string, string | string[] | undefined>
 ) => {
   const errorReasonId = stripeErrorToErrorReasonId(stripeError);
-  const urlSearchParams = new URLSearchParams(searchParams ? flattenRouteParams(searchParams) : undefined);
+  const urlSearchParams = new URLSearchParams(
+    searchParams ? flattenRouteParams(searchParams) : undefined
+  );
   const params = searchParams ? `?${urlSearchParams.toString()}` : '';
 
   await getApp().getActionsService().finalizeCartWithError({
     cartId,
     errorReasonId,
   });
 
-  redirect(`error${params}`);
-};
+  // Sanitize pathname to prevent open redirect vulnerabilities
+  const safePath = sanitizePathname(currentPathname);
+  
+  // Replace the last segment with 'error' to maintain the full path structure
+  const pathSegments = safePath.split('/');
+  pathSegments[pathSegments.length - 1] = 'error';
+  const errorPath = pathSegments.join('/');
+
+  redirect(`${errorPath}${params}`);
+};
diff --git a/libs/payments/ui/src/lib/actions/submitNeedsInputAndRedirect.ts b/libs/payments/ui/src/lib/actions/submitNeedsInputAndRedirect.ts
@@ -9,10 +9,12 @@ import { redirect } from 'next/navigation';
 import { URLSearchParams } from 'url';
 import { recordEmitterEventAction } from './recordEmitterEvent';
 import { flattenRouteParams } from '../utils/flatParam';
+import { sanitizePathname } from '../utils/sanitizePathname';
 
 export const submitNeedsInputAndRedirectAction = async (
   cartId: string,
   params: Record<string, string | string[] | undefined>,
+  currentPathname: string,
   searchParams?: Record<string, string | string[] | undefined>,
   isFreeTrial?: boolean
 ) => {
@@ -49,5 +51,13 @@ export const submitNeedsInputAndRedirectAction = async (
     redirectPath = 'error';
   }
 
-  redirect(`${redirectPath}${searchParamsString}`);
-};
+  // Sanitize pathname to prevent open redirect vulnerabilities
+  const safePath = sanitizePathname(currentPathname);
+  
+  // Replace the last segment with the redirect path to maintain the full path structure
+  const pathSegments = safePath.split('/');
+  pathSegments[pathSegments.length - 1] = redirectPath;
+  const fullRedirectPath = pathSegments.join('/');
+
+  redirect(`${fullRedirectPath}${searchParamsString}`);
+};
diff --git a/libs/payments/ui/src/lib/actions/validateCartStateAndRedirect.ts b/libs/payments/ui/src/lib/actions/validateCartStateAndRedirect.ts
@@ -10,15 +10,18 @@ import { getRedirect, validateCartState } from '../utils/get-cart';
 import { SupportedPages } from '../utils/types';
 import { URLSearchParams } from 'url';
 import { flattenRouteParams } from '../utils/flatParam';
+import { sanitizePathname } from '../utils/sanitizePathname';
 
 /**
  * Redirect if cart state does not match supported page
  * @@param cartId - Cart ID
  * @@param page - Page that action is being called from
+ * @@param currentPathname - Current pathname for constructing redirect URLs
  */
 async function validateCartStateAndRedirectAction(
   cartId: string,
   page: SupportedPages,
+  currentPathname: string,
   searchParams?: Record<string, string | string[] | undefined>,
   redirectNow = true
 ) {
@@ -29,7 +32,13 @@ async function validateCartStateAndRedirectAction(
   });
 
   if (!validateCartState(state, page)) {
-    const redirectToUrl = getRedirect(state) + params;
+    // Sanitize pathname to prevent open redirect vulnerabilities
+    const safePath = sanitizePathname(currentPathname);
+    
+    // Replace the last segment with the redirect path to maintain the full path structure
+    const pathSegments = safePath.split('/');
+    pathSegments[pathSegments.length - 1] = getRedirect(state);
+    const redirectToUrl = pathSegments.join('/') + params;
 
     if (redirectNow) {
       redirect(redirectToUrl);
@@ -44,4 +53,4 @@ async function validateCartStateAndRedirectAction(
   return;
 }
 
-export { validateCartStateAndRedirectAction };
+export { validateCartStateAndRedirectAction };
diff --git a/libs/payments/ui/src/lib/client/components/CheckoutForm/index.tsx b/libs/payments/ui/src/lib/client/components/CheckoutForm/index.tsx
diff --git a/libs/payments/ui/src/lib/client/components/PaymentInputHandler/index.tsx b/libs/payments/ui/src/lib/client/components/PaymentInputHandler/index.tsx
diff --git a/libs/payments/ui/src/lib/client/components/PaymentStateObserver/index.tsx b/libs/payments/ui/src/lib/client/components/PaymentStateObserver/index.tsx
diff --git a/libs/payments/ui/src/lib/utils/sanitizePathname.spec.ts b/libs/payments/ui/src/lib/utils/sanitizePathname.spec.ts
diff --git a/libs/payments/ui/src/lib/utils/sanitizePathname.ts b/libs/payments/ui/src/lib/utils/sanitizePathname.ts
