pull · Oct 26, 2025 · Oct 24, 2025 · Oct 26, 2025 · Oct 26, 2025 · Oct 26, 2025
diff --git a/.github/workflows/build_binaries.yml b/.github/workflows/build_binaries.yml
@@ -1,4 +1,6 @@
 name: Build Binaries
+permissions:
+  contents: read
 on:
   workflow_dispatch:
   push:

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
@@ -9,19 +9,22 @@ on:
       - '**.js'
       - '**.go'
       - '!**_test.go'
+      - '.github/workflows/codeql-analysis.yml'
   pull_request:
     # The branches below must be a subset of the branches above
     branches: [ main ]
     paths:
       - '**.js'
       - '**.go'
       - '!**_test.go'
+      - '.github/workflows/codeql-analysis.yml'
   schedule:
     - cron: '45 22 * * 3'
+  workflow_dispatch:
 
 jobs:
   analyze:
-    name: Analyze
+    name: Analyze (${{ matrix.language }})
     runs-on: ubuntu-latest
     permissions:
       actions: read
@@ -30,20 +33,27 @@ jobs:
 
     strategy:
       fail-fast: false
+      matrix:
+        language: [ 'go', 'javascript' ]
 
     steps:
     - name: Checkout repository
       uses: actions/checkout@v5
 
     - uses: actions/setup-go@v6
+      if: matrix.language == 'go'
       with:
         go-version: stable
 
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v4
+      with:
+        languages: ${{ matrix.language }}
 
     - name: Autobuild
       uses: github/codeql-action/autobuild@v4
 
     - name: Perform CodeQL Analysis
       uses: github/codeql-action/analyze@v4
+      with:
+        category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/rpm_packages.yml b/.github/workflows/rpm_packages.yml
@@ -11,6 +11,7 @@ on:
     branches: [ main ]
     paths:
       - 'packaging/rpm/**' # Only run on changes to the rpm packaging files
+      - '.github/workflows/rpm_packages.yml'
 jobs:
   test-package:
     if: github.event_name == 'schedule' || github.event_name == 'pull_request'
@@ -21,7 +22,7 @@ jobs:
       with:
           fetch-depth: 0
     - name: Build RPM Package
-      run: make rpm
+      run: make rpm VERSION=2.2.x_dev
     - name: List generated files
       run: ls -l *.rpm
   build-package-manually:

diff --git a/internal/ui/login_check.go b/internal/ui/login_check.go
@@ -6,7 +6,6 @@ package ui // import "miniflux.app/v2/internal/ui"
 import (
 	"log/slog"
 	"net/http"
-	"net/url"
 
 	"miniflux.app/v2/internal/config"
 	"miniflux.app/v2/internal/http/cookie"
@@ -17,6 +16,7 @@ import (
 	"miniflux.app/v2/internal/ui/form"
 	"miniflux.app/v2/internal/ui/session"
 	"miniflux.app/v2/internal/ui/view"
+	"miniflux.app/v2/internal/urllib"
 )
 
 func (h *handler) checkLogin(w http.ResponseWriter, r *http.Request) {
@@ -96,11 +96,9 @@ func (h *handler) checkLogin(w http.ResponseWriter, r *http.Request) {
 		config.Opts.BasePath(),
 	))
 
-	if redirectURL != "" {
-		if parsedURL, err := url.Parse(redirectURL); err == nil && !parsedURL.IsAbs() {
-			html.Redirect(w, r, redirectURL)
-			return
-		}
+	if redirectURL != "" && urllib.IsRelativePath(redirectURL) {
+		html.Redirect(w, r, redirectURL)
+		return
 	}
 
 	html.Redirect(w, r, route.Path(h.router, user.DefaultHomePage))

diff --git a/internal/ui/static/js/app.js b/internal/ui/static/js/app.js
@@ -897,7 +897,7 @@ function updateUnreadCounterValue(delta) {
     if (window.location.href.endsWith('/unread')) {
         const oldValue = parseInt(document.title.split('(')[1], 10);
         const newValue = oldValue + delta;
-        document.title = document.title.replace(/(.*?)\(\d+\)(.*?)/, `$1(${newValue})$2`);
+        document.title = document.title.replace(/\(\d+\)/, `(${newValue})`);
     }
 }
 

diff --git a/internal/urllib/url.go b/internal/urllib/url.go
@@ -10,6 +10,21 @@ import (
 	"strings"
 )
 
+// IsRelativePath returns true if the link is a relative path.
+func IsRelativePath(link string) bool {
+	if link == "" {
+		return false
+	}
+	if parsedURL, err := url.Parse(link); err == nil {
+		// Only allow relative paths (not scheme-relative URLs like //example.org)
+		// and ensure the URL doesn't have a host component
+		if !parsedURL.IsAbs() && parsedURL.Host == "" && parsedURL.Scheme == "" {
+			return true
+		}
+	}
+	return false
+}
+
 // IsAbsoluteURL returns true if the link is absolute.
 func IsAbsoluteURL(link string) bool {
 	u, err := url.Parse(link)

diff --git a/internal/urllib/url_test.go b/internal/urllib/url_test.go
@@ -5,6 +5,40 @@ package urllib // import "miniflux.app/v2/internal/urllib"
 
 import "testing"
 
+func TestIsRelativePath(t *testing.T) {
+	scenarios := map[string]bool{
+		// Valid relative paths
+		"path/to/file.ext":    true,
+		"./path/to/file.ext":  true,
+		"../path/to/file.ext": true,
+		"file.ext":            true,
+		"./file.ext":          true,
+		"../file.ext":         true,
+		"/absolute/path":      true,
+		"path?query=value":    true,
+		"path#fragment":       true,
+		"path?query#fragment": true,
+
+		// Not relative paths
+		"https://example.org/file.ext": false,
+		"http://example.org/file.ext":  false,
+		"//example.org/file.ext":       false,
+		"//example.org":                false,
+		"ftp://example.org/file.ext":   false,
+		"mailto:user@example.org":      false,
+		"magnet:?xt=urn:btih:example":  false,
+		"":                             false,
+		"magnet:?xt.1=urn:sha1:YNCKHTQCWBTRNJIV4WNAE52SJUQCZO5C": false,
+	}
+
+	for input, expected := range scenarios {
+		actual := IsRelativePath(input)
+		if actual != expected {
+			t.Errorf(`Unexpected result for IsRelativePath, got %v instead of %v for %q`, actual, expected, input)
+		}
+	}
+}
+
 func TestIsAbsoluteURL
4843
(t *testing.T) {
 	scenarios := map[string]bool{
 		"https://example.org/file.pdf": true,