From 2f78bc6632e524938b01d9185444b29f26e14efb Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sat, 7 Feb 2026 23:13:31 +0000
Subject: [PATCH] Fix Open Redirect and XSS via NIP-46 Authentication URL

- Validated `pendingAuthUrl` protocol to be `http:` or `https:` in `js/ui/loginModalController.js`.
- Logged warning if unsafe URL is encountered.

Signed-off-by: Jules <jules@bitvid.com>

Co-authored-by: PR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
---
 js/ui/loginModalController.js | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/js/ui/loginModalController.js b/js/ui/loginModalController.js
index bf8e512d..a739a047 100644
--- a/js/ui/loginModalController.js
+++ b/js/ui/loginModalController.js
@@ -1561,6 +1561,23 @@ export default class LoginModalController {
           if (!pendingAuthUrl) {
             return;
           }
+
+          let isValid = false;
+          try {
+            const parsed = new URL(pendingAuthUrl);
+            isValid = parsed.protocol === "http:" || parsed.protocol === "https:";
+          } catch (error) {
+            isValid = false;
+          }
+
+          if (!isValid) {
+            devLogger.warn(
+              "[LoginModalController] Blocked unsafe authentication URL:",
+              pendingAuthUrl,
+            );
+            return;
+          }
+
           if (this.window && typeof this.window.open === "function") {
             this.window.open(pendingAuthUrl, "_blank", "noopener,noreferrer");
           } else if (this.document && this.document.location) {