| 1 |
<!DOCTYPE html> |
| 2 |
<html> |
| 3 |
<head> |
| 4 |
<title>Loading...</title> |
| 5 |
<script> |
| 6 |
// Function to get URL parameters |
| 7 |
function getParameterByName(name, url = window.location.href) { |
| 8 |
name = name.replace(/[\[\]]/g, '\\$&'); |
| 9 |
var regex = new RegExp('[?&]' + name + '(=([^&#]*)|&|#|$)'), |
| 10 |
results = regex.exec(url); |
| 11 |
if (!results) return null; |
| 12 |
if (!results[2]) return ''; |
| 13 |
return decodeURIComponent(results[2].replace(/\+/g, ' ')); |
| 14 |
} |
| 15 |
|
| 16 |
// Get the redirect URL from the query parameter |
| 17 |
var redirectUrl = getParameterByName('url'); |
| 18 |
|
| 19 |
// Validate the URL protocol to prevent javascript: XSS |
| 20 |
function isSafeUrl(url) { |
| 21 |
try { |
| 22 |
var parsed = new URL(url, window.location.href); |
| 23 |
return parsed.protocol === 'http:' || parsed.protocol === 'https:'; |
| 24 |
} catch (e) { |
| 25 |
return false; |
| 26 |
} |
| 27 |
} |
| 28 |
|
| 29 |
// Wait 100ms and then redirect |
| 30 |
if (redirectUrl && isSafeUrl(redirectUrl)) { |
| 31 |
setTimeout(function() { |
| 32 |
window.location.href = redirectUrl; |
| 33 |
}, 100); |
| 34 |
} else { |
| 35 |
document.write('No redirect URL specified.'); |
| 36 |
} |
| 37 |
</script> |
| 38 |
</head> |
| 39 |
<body> |
| 40 |
</body> |
| 41 |
</html> |
