Duo URL redirect enhancements

[mandreko-bitwarden]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/VULN-241

📔 Objective

As a follow-up to #14174, this provides additional scrutiny to the redirectUrl parameter of the Duo redirect

⏰ Reminders before review

• Contributor guidelines followed
• All formatters and local linters executed and passed
• Written new unit and / or integration tests where applicable
• Protected functional changes with optionality (feature flags)
• Used internationalization (i18n) for all UI strings
• CI builds passed
• Communicated to DevOps any deployment requirements
• Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

• 👍 (:+1:) or similar for great changes
• 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
• ❓ (:question:) for questions
• 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
• 🎨 (:art:) for suggestions / improvements
• ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
• 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
• ⛏ (:pick:) for minor or nitpick changes

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 36.28%. Comparing base (f3acfb2) to head (247072e).
Report is 10 commits behind head on main.

✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #14640      +/-   ##
==========================================
- Coverage   36.39%   36.28%   -0.11%     
==========================================
  Files        3193     3190       -3     
  Lines       92615    92382     -233     
  Branches    16669    16601      -68     
==========================================
- Hits        33703    33517     -186     
+ Misses      56488    56461      -27     
+ Partials     2424     2404      -20     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Checkmarx One – Scan Summary & Details – 0cf98ba0-6cc5-4f3d-b934-b22f9038742f

New Issues (2)

Checkmarx found the following issues in this Pull Request

Severity	Issue	Source File / Package	Checkmarx Insight
	CVE-2025-4372	Npm-electron-34.0.0	details Description: Use after free in WebAudio in Google Chrome prior to 136.0.7103.92 allowed a remote attacker to potentially exploit heap corruption via a crafted H... Attack Vector: NETWORK Attack Complexity: LOW ID: iq%2BZEDpBCcEmoKMn1JFdgTOtfCNvopG94WVjZFLjTqM%3D Vulnerable Package
	CVE-2025-46565	Npm-vite-5.4.6	details Recommended version: 5.4.19 Description: Vite is a frontend tooling framework for javascript. In vite package versions through 4.5.13, 5.0.0-beta.0 through 5.4.18, 6.0.0-alpha.0 through 6.... Attack Vector: NETWORK Attack Complexity: LOW ID: W%2F5Si6kBlUSfxOIBLxEPhNxRpKahgecizr%2Bz2IXEH30%3D Vulnerable Package

[JaredSnider-Bitwarden]

Really nice work on these changes. I've got some additional recommendations down below (all tested and work):

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[JaredSnider-Bitwarden]

LGTM! Thank you!