fixing potentiall xss in external domains list

app-code/api/utils/security.php

@@ -282,6 +282,10 @@ function normalize_redirect_target(?string $target): string
         return '/account/';
     }
 
+    if (normalize_redirect_host($parts['host']) === null) {
+        return '/account/';
+    }
+
     return $target;
 }
 
@@ -310,12 +314,11 @@ function is_external_domain(string $url): ?string
         return null;
     }
 
-    $host = parse_url($url, PHP_URL_HOST);
-    if ($host === null || $host === '') {
+    $host = normalize_redirect_host((string) parse_url($url, PHP_URL_HOST));
+    if ($host === null) {
         return null;
     }
 
-    $host = strtolower($host);
     if ($host === 'auth.jakach.ch' || str_ends_with($host, '.jakach.ch')) {
         return null;
     }
@@ -323,4 +326,23 @@ function is_external_domain(string $url): ?string
     return $host;
 }
 
+function normalize_redirect_host(string $host): ?string
+{
+    $host = rtrim(strtolower(trim($host)), '.');
+
+    if ($host === '' || strlen($host) > 253 || preg_match('/[\x00-\x20\x7f<>"\'`]/', $host)) {
+        return null;
+    }
+
+    if (filter_var($host, FILTER_VALIDATE_IP)) {
+        return $host;
+    }
+
+    if (!filter_var($host, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME)) {
+        return null;
+    }
+
+    return $host;
+}
+
 ?>