fix: validate redirect parameter to prevent open redirect (#262)

Co-authored-by: Flegma <Flegma@users.noreply.github.com>

Author: Flegma

middleware/auth.global.ts

@@ -71,7 +71,10 @@ export default defineNuxtRouteMiddleware(async (to, from) => {
 
   if (hasMe && to.path === "/login") {
     if (to.query.redirect) {
-      return navigateTo(decodeURIComponent(to.query.redirect as string));
+      const redirectPath = decodeURIComponent(to.query.redirect as string);
+      if (redirectPath.startsWith("/") && !redirectPath.startsWith("//")) {
+        return navigateTo(redirectPath);
+      }
     }
     return navigateTo("/");
   }