Fix Open Redirect and XSS via NIP-46 Authentication URL

- Validated `pendingAuthUrl` protocol to be `http:` or `https:` in `js/ui/loginModalController.js`.
- Logged warning if unsafe URL is encountered.

Signed-off-by: Jules <[email protected]>

Co-authored-by: PR0M3TH3AN <[email protected]>

js/ui/loginModalController.js

@@ -1561,6 +1561,23 @@ export default class LoginModalController {
           if (!pendingAuthUrl) {
             return;
           }
+
+          let isValid = false;
+          try {
+            const parsed = new URL(pendingAuthUrl);
+            isValid = parsed.protocol === "http:" || parsed.protocol === "https:";
+          } catch (error) {
+            isValid = false;
+          }
+
+          if (!isValid) {
+            devLogger.warn(
+              "[LoginModalController] Blocked unsafe authentication URL:",
+              pendingAuthUrl,
+            );
+            return;
+          }
+
           if (this.window && typeof this.window.open === "function") {
             this.window.open(pendingAuthUrl, "_blank", "noopener,noreferrer");
           } else if (this.document && this.document.location) {