Fix double backslash open redirect (#1096)

app/utils.py

@@ -87,7 +87,7 @@ class NextUrlSanitizer:
                 return replaced
             else:
                 return None
-        if result.path and result.path[0] == "/":
+        if result.path and result.path[0] == "/" and not result.path.startswith("//"):
             return result.path
 
         return None

tests/test_utils.py

@@ -27,6 +27,7 @@ def generate_sanitize_url_cases() -> List:
         ["/auth", "/auth"],
         ["/some/path", "/some/path"],
         ["//somewhere.net", None],
+        ["//\\\\evil.com", None],
     ]
     for domain in ALLOWED_REDIRECT_DOMAINS:
         cases.append([f"http://{domain}", f"http://{domain}"])