calendar

766 B

1. // lib/api-helpers.hl — what lib/api.hl looks up (calendar mission 001, code order): the login button's `?next=` check.
3. // BACK TO THE PAGE: /login.js puts `?next=` into the button's return URL at the click. Only a same-origin PATH
4. // goes (one `/`, URL-safe characters, ≤ 500). Anything else → `/`.
5. static nextChars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~/?&=%+,;@!$()*:'
6. static safePath = (want) => {
7. if (want == null || hlTypeName(want) != 'String' || want == '' || want.length > 500) { return '/' }
8. if (want.slice(0, 1) != '/' || want.slice(0, 2) == '//' || want.slice(0, 7) == '/login/') { return '/' }
9. let i = 0
10. while (i < want.length) {
11. if (!nextChars.includes(want[i])) { return '/' }
12. i = i + 1
13. }
14. return want
15. }