Fix open redirect vulnerability in action-details via URL allowlist validation

[Copilot]

redirectToExternalUrl() passed action.ext_action_destination_text directly to Browser.open() without validation, enabling open redirect attacks via a compromised or MITM'd backend response — with CID and order_id leaked to the malicious target.

Changes

• Allowlist validation — added ALLOWED_DOMAINS (captureapp.xyz, numbersprotocol.io) and isValidRedirectUrl() that enforces HTTPS and strict hostname matching:

  private readonly ALLOWED_DOMAINS = ['captureapp.xyz', 'numbersprotocol.io'];
  
  private isValidRedirectUrl(url: string): boolean {
    try {
      const parsed = new URL(url);
      if (parsed.protocol !== 'https:') return false;
      return this.ALLOWED_DOMAINS.some(
        d => parsed.hostname === d || parsed.hostname.endsWith(`.${d}`)
      );
    } catch {
      return false;
    }
  }

  Uses hostname === d || hostname.endsWith('.' + d) to allow legitimate subdomains while blocking spoofs like evil-captureapp.xyz or captureapp.xyz.evil.com.

• Error handling — redirectToExternalUrl() now returns early with an error toast on invalid URLs; i18n keys added to en-us.json and zh-tw.json

• Tests — added cases covering: valid apex/subdomain, HTTP rejection, non-allowlisted domain, subdomain confusion attack, lookalike domain, and malformed URL

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• download.cypress.io
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node index.js --exec install conf�� --global credential.helper cal/bin/git HooksPath (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)