harden: fix security issue in server.js

[anupamme]

Summary

Harden input handling in server.js (flagged by multi_agent_ai).

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	server.js:17
Assessment	Defensive hardening

Description: The /e/:uid endpoint constructs redirect URLs using the uid parameter without validating that the resulting destination is safe. While encodeURIComponent() provides some sanitization, the parameter is still used directly in the redirect Location header, potentially allowing attackers to craft URLs that redirect to external malicious sites.

Threat Model Context

This is a web service - vulnerabilities in request handlers are directly exploitable by remote attackers.

Changes

• server.js

Behavior Preservation

The change is scoped to 1 file on the vulnerable path.

Security Invariant

Property: The security boundary is maintained under adversarial input

Regression test

const request = require('supertest');
const app = require('./server.js');

describe("redirect destination must always be internal path", () => {
  const payloads = [
    'https://evil.com',
    '//evil.com/path',
    'valid-client-123'
  ];

  test.each(payloads)("handles uid parameter safely: %s", async (payload) => {
    const response = await request(app).get(`/e/${payload}`);
    
    if (response.status === 302 || response.status === 301) {
      const location = response.headers.location;
      expect(location).toMatch(/^\/src\/view\/editor\/editor\.ejs\.html/);
      expect(location).not.toMatch(/^https?:/);
      expect(location).not.toMatch(/^\/\//);
    }
  });
});

This test guards against regressions — it's useful independent of the code change above.

---

This patch removes an exploit primitive — a code pattern that, while not independently exploitable today, could be chained with other weaknesses by automated exploit-development tooling. Proactive removal of such primitives raises the bar against increasingly capable automated attack tools.

---

Automated security fix by OrbisAI Security