Preserve safe return paths through sign-in

internal/web/paths.go

@@ -141,3 +141,15 @@ func pathWithQuery(path string, pairs ...any) string {
 	}
 	return path + "?" + values.Encode()
 }
+
+func safeReturnPath(value string) string {
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return ""
+	}
+	target, err := url.Parse(value)
+	if err != nil || target.IsAbs() || target.Host != "" || !strings.HasPrefix(target.Path, "/") || strings.HasPrefix(target.Path, "//") || strings.Contains(target.Path, `\`) {
+		return ""
+	}
+	return target.RequestURI()
+}