isSafeReturnTo function

bool isSafeReturnTo(
  1. String? candidate,
  2. Uri baseUrl
)

Same-origin / relative path validation. Public for tests.

Implementation

bool isSafeReturnTo(String? candidate, Uri baseUrl) {
  if (candidate == null || candidate.isEmpty) return false;
  if (candidate.length > 2048) return false;
  if (candidate.contains(RegExp(r'[\s\x00-\x1f\x7f]'))) return false;
  if (candidate.startsWith('//') || candidate.startsWith('\\')) return false;
  if (candidate.startsWith('/')) return true;
  final u = Uri.tryParse(candidate);
  if (u == null || !u.hasAbsolutePath) return false;
  return u.scheme == baseUrl.scheme && u.host == baseUrl.host && u.port == baseUrl.port;
}