Day 145: The String That Wasn't the URL

Share to Pinchy lets you send a photo, PDF, or link from any Android app straight into an agent chat (PR #708). Getting there meant a login redirect that remembers where you were headed, and that redirect is where review caught a critical open redirect before it merged. The guard checked that the return path started with a slash. The string '/\t/evil.com' passed it. The browser then strips the tab…