[MM-64911] Ensure redirect URL is validated before redirecting (#33559) (#33596)

Automatic Merge

server/channels/web/oauth_test.go

@@ -862,11 +862,25 @@ func (th *TestHelper) AddPermissionToRole(permission string, roleName string) {
 func TestFullyQualifiedRedirectURL(t *testing.T) {
 	const siteURL = "https://xxx.yyy/mm"
 	for target, expected := range map[string]string{
-		"":            "https://xxx.yyy/mm",
-		"/":           "https://xxx.yyy/mm/",
-		"some-path":   "https://xxx.yyy/mm/some-path",
-		"/some-path":  "https://xxx.yyy/mm/some-path",
-		"/some-path/": "https://xxx.yyy/mm/some-path/",
+		"":                                     siteURL,
+		"/":                                    siteURL + "/",
+		"some-path":                            siteURL + "/some-path",
+		"/some-path":                           siteURL + "/some-path",
+		"/some-path/":                          siteURL + "/some-path/",
+		"/some-path?foo=bar":                   siteURL + "/some-path?foo=bar",
+		"/some-path#section":                   siteURL + "/some-path#section",
+		"../bad-path":                          siteURL,
+		"/index.html":                          siteURL + "/index.html",
+		"//evil.com":                           siteURL,
+		"https://xxx.yyy/mm":                   siteURL,
+		"https://xxx.yyy/mm//double-concat":    siteURL + "//double-concat",
+		"https://xxx.yyy/other-path/":          siteURL,
+		"https://xxx.yyy/mm/some-path":         siteURL + "/some-path",
+		"https://yyy.zzz/mm/some-path":         siteURL,
+		"https://xxx.yyy/mm/some-path?foo=bar": siteURL + "/some-path?foo=bar",
+		"https://xxx.yyy/mm/some-path#section": siteURL + "/some-path#section",
+		"https://xxx.yyy/mm/../malicious-path": siteURL,
+		":foo":                                 siteURL,
 	} {
 		t.Run(target, func(t *testing.T) {
 			require.Equal(t, expected, fullyQualifiedRedirectURL(siteURL, target))