From d21e51e6ab132bbe0e725da36507d2ed37adabfe Mon Sep 17 00:00:00 2001
From: superboy-zjc <1826599908@qq.com>
Date: Wed, 6 Aug 2025 13:00:08 -0700
Subject: [PATCH] fix(auth): sanitize authorization URL

---
 client/src/lib/auth.ts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/client/src/lib/auth.ts b/client/src/lib/auth.ts
index 9989e944..326164e6 100644
--- a/client/src/lib/auth.ts
+++ b/client/src/lib/auth.ts
@@ -129,6 +129,12 @@ export class InspectorOAuthClientProvider implements OAuthClientProvider {
   }
 
   redirectToAuthorization(authorizationUrl: URL) {
+    if (
+      authorizationUrl.protocol !== "http:" &&
+      authorizationUrl.protocol !== "https:"
+    ) {
+      throw new Error("Authorization URL must be HTTP or HTTPS");
+    }
     window.location.href = authorizationUrl.href;
   }