Security report: OAuth popup postMessage hardening + open redirect fix (PR #398)

[eloo075]

This repository has Issues disabled, so I’m submitting the public report here and linking the fix PR.

PR: #398

Summary:

• OAuth popup flow: harden message passing from /redirect by removing wildcard targetOrigin, adding state/type, and validating message origin/source/state in oauth2-utils.
• Prevent open redirect: validate redirect parameter after third-party login (allow only relative or same-origin).

Affected files:

• workflow/packages/frontend/src/app/routes/redirect.tsx
• workflow/packages/frontend/src/lib/oauth2-utils.ts
• workflow/packages/frontend/src/features/authentication/components/third-party-logins.tsx