⨯ shared-secret-auth 01f09fa7 little-moments mtlynch

01f09fa7

By: Michael Lynch <git@mtlynch.io>

Reject unsafe login redirect targets

Validate the next path without sanitizing caller input, so malformed URLs and paths without a leading slash fail instead of falling back to the home page.

Add table-driven login coverage for protocol-relative URLs, external HTTP and HTTPS URLs, malformed URLs, non-HTTP absolute URLs, and valid app-relative paths.

Suite timing

	Time to Start	Worker time	Duration	Time to finish	Idle
Config	0s	2s	2s	2s	0s
Eval	-	-	-	-	332h38m00s
Build	4s	20s	-	-	0s
Suite	0s	22s	-	-	332h38m00s

Timeline

Agent Instructions

This page shows suite timings.

This page is also available in machine-friendly formats. Request one with the Accept header:

curl --netrc -H 'Accept: application/json' https://nix-ci.com/cb:mtlynch:little-moments/shared-secret-auth/01f09fa73a7505cfaa0b8736caa044b149dd0a26/timing
curl --netrc -H 'Accept: text/markdown' https://nix-ci.com/cb:mtlynch:little-moments/shared-secret-auth/01f09fa73a7505cfaa0b8736caa044b149dd0a26/timing

For more instructions, fetch https://nix-ci.com/instructions .