Replace schema on logout backlink

Replace string on back link
 - removes any chars before //
 - adds additional `//` in front of the string, removing any javascript
   calls

auth/handlers/handle_logout_test.go

@@ -43,6 +43,6 @@ func Test_logoutProc(t *testing.T) {
 	rq.Empty(authReq.Session.Values)
 	rq.Empty(authReq.AuthUser)
 	rq.Empty(authReq.Client)
-	rq.Equal("scriptalert(origin)/script", authReq.Data["link"])
+	rq.Equal("//scriptalert(origin)/script", authReq.Data["link"])
 	rq.Equal(TmplLogout, authReq.Template)
 }

auth/handlers/links.go

@@ -54,6 +54,7 @@ type (
 
 var (
 	invalidLinkChars        = regexp.MustCompile(`[^-A-Za-z0-9+&@#/%?=~_|!:,.;\\(\\)]`)
+	stripSchema             = regexp.MustCompile(`(.*\/\/)`)
 	BasePath         string = "/"
 )
 
@@ -112,5 +113,5 @@ func tbp(s string) string {
 }
 
 func sanitizeLink(l string) string {
-	return invalidLinkChars.ReplaceAllString(l, "")
+	return `//` + stripSchema.ReplaceAllString(invalidLinkChars.ReplaceAllString(l, ""), "")
 }

auth/handlers/links_test.go

@@ -0,0 +1,41 @@
+package handlers
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func Test_sanitizeLink(t *testing.T) {
+	type (
+		tt struct {
+			name   string
+			link   string
+			expect string
+		}
+	)
+
+	tcc := []tt{
+		{
+			name:   `empty link`,
+			link:   ``,
+			expect: `//`,
+		},
+		{
+			name:   `Example URL with query`,
+			link:   `https://example.url/query`,
+			expect: `//example.url/query`,
+		},
+		{
+			name:   `URL with additional js`,
+			link:   `javascript:window.alert('foobar')`,
+			expect: `//javascript:window.alert(foobar)`,
+		},
+	}
+
+	for _, tc := range tcc {
+		t.Run(tc.name, func(t *testing.T) {
+			require.New(t).Equal(tc.expect, sanitizeLink(tc.link))
+		})
+	}
+}