Remove invalid single-backslash redirect test

[arikfr]

Summary

Remove the login-redirect test that treats a single leading backslash as an external redirect.

Rationale

A single \evil.com resolves to the same-origin path /evil.com for special-scheme URLs. The existing mixed slash/backslash case (/\evil.com) remains covered because it resolves to an external host and must be rejected.

Validation

• python3 -m py_compile redash/authentication/__init__.py
• git diff --check
• Required GitHub Actions checks are running.

[greptile-apps]

Greptile Summary

This PR removes test_backslash_redirect_rejected, a test that expected \evil.com to be blocked as an open-redirect. The removal is correct: WHATWG-compliant browsers resolve a leading \ as /, so \evil.com is treated as the same-origin path /evil.com and is not an external redirect.

• The deleted test was asserting the wrong behaviour — _is_safe_next_url("\\evil.com") intentionally returns True, and the test was expecting ./.
• The genuinely dangerous bypass, /\evil.com (which normalises to //evil.com after backslash-to-slash substitution), remains covered by test_slash_backslash_redirect_rejected.
• The existing inline comment in _is_safe_next_url already explains that both the raw and backslash-normalised forms are checked, so the intent is captured in code.

Confidence Score: 5/5

• Safe to merge — the removed test was asserting incorrect behaviour, and the actually dangerous redirect vector remains covered.
• The test deletion is accurate: \evil.com resolves to the same-origin path in all WHATWG browsers, so rejecting it would be wrong. The complementary test for /\evil.com (which does resolve to an external host after backslash normalisation) is untouched, so open-redirect protection for the real attack vector remains verified.
• No files require special attention.

Important Files Changed

Filename	Overview
tests/test_authentication.py	Removes test_backslash_redirect_rejected, which incorrectly expected \evil.com to be rejected; the remaining test_slash_backslash_redirect_rejected covers the genuinely dangerous /\evil.com case.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["next= URL from login request"] --> B["_is_safe_next_url(url)"]
    B --> C["Check both url and url.replace('\\\\', '/')"]
    C --> D{Starts with '///\n or has scheme without netloc?}
    D -- Yes --> E["Return False → fallback to ./"]
    D -- No --> F{Has netloc?}
    F -- Yes --> E
    F -- No --> G{Scheme not http/https?}
    G -- Yes --> E
    G -- No --> H["Return True → allow redirect"]

    subgraph "Test coverage"
        T1["test_slash_backslash_redirect_rejected\n/\\evil.com → ./\n(REMAINS)"]
        T2["test_backslash_redirect_rejected\n\\evil.com → ./\n(REMOVED — was incorrect)"]
    end

    style T2 fill:#ffcccc,stroke:#cc0000
    style T1 fill:#ccffcc,stroke:#009900

Loading

_{Reviews (3): Last reviewed commit: "Merge branch 'master' into codex/fix-bac..." | Re-trigger Greptile}

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}

[yoshiokatsuneo]

I can approve it as It just looks good.

I just have some questions.

• Is the test failed before the PR ?
  (Normally, the commit causing test failure is not merged. I guess the commit causing the test failure is directly committed to the master branch. Is it right ?)

• Why is the commit (2723d87) reverted, as the commit looks more conservative.
  ( I guess the commit caused another test failure ??)

[yoshiokatsuneo]

Actually, I see that the this issue causes CI error on the latest commit like this.

https://github.com/getredash/redash/actions/runs/31325105873/job/93274155470?pr=7750#step:7:123