Preserve safe return paths through sign-in

internal/web/paths_test.go

@@ -33,6 +33,29 @@ func TestPathWithQueryEncodesValues(t *testing.T) {
 	}
 }
 
+func TestSafeReturnPath(t *testing.T) {
+	tests := []struct {
+		name  string
+		value string
+		want  string
+	}{
+		{name: "local path", value: "/invite?token=abc", want: "/invite?token=abc"},
+		{name: "absolute URL", value: "https://example.com/phishing"},
+		{name: "scheme relative URL", value: "//example.com/phishing"},
+		{name: "backslash", value: `/\\example.com/phishing`},
+		{name: "encoded backslash", value: `/%5C%5Cexample.com/phishing`},
+		{name: "encoded leading slashes", value: `/%2F%2Fexample.com/phishing`},
+		{name: "relative path", value: "invite?token=abc"},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if got := safeReturnPath(test.value); got != test.want {
+				t.Errorf("safeReturnPath(%q): got %q, want %q", test.value, got, test.want)
+			}
+		})
+	}
+}
+
 func TestGardenAwareAdminPaths(t *testing.T) {
 	garden := &client.Garden{ID: 3}
 	if got := gardenAwarePath(webPath("admin.role.new"), garden); got != "/admin/roles/new?garden=3" {