fix(planner): validate callback/returnUrl + cap session URL-param payloads

Addresses planner audit #3 (SSRF via callbackUrl) and #7 (URL-param
size). Two attack surfaces hardened:

1. /new loader — \`callback\`, \`token\`, \`returnUrl\`, \`gpx\` query
   params now validated:
   - callbackUrl: must be a valid absolute http(s) URL ≤ 2048 chars.
     If \`PLANNER_CALLBACK_ALLOWED_HOSTS\` is set (comma-separated),
     the host must match — defense-in-depth SSRF guard for self-
     hosted instances. Unset = no allowlist (dev / open self-host).
   - token: max 2048 chars.
   - returnUrl: must be a same-origin path or absolute http(s) URL
     ≤ 2048 chars. Rejects \`javascript:\`, \`data:\`, and
     protocol-relative \`//host\` (which would resolve to a remote
     origin on HTTPS pages).
   - gpx: ≤ 2 MB encoded.
   Invalid input throws 400 from the loader.

2. /session/:id default-export component — \`waypoints\`, \`noGoAreas\`,
   \`notes\`, \`returnUrl\` URL params now bounded before
   \`JSON.parse\` / use:
   - waypoints / noGoAreas: ≤ 50KB each; over-cap returns undefined
     (component starts with empty initial state, same as malformed).
   - notes: ≤ 10KB.
   - returnUrl: ≤ 2KB + same scheme rules as #1.

Pulled the URL validation into \`lib/url-validation.server.ts\` so
both routes (and any future caller) share the same rules.

Tests: \`url-validation.server.test.ts\` (14 cases — schemes,
allowlist, length caps, protocol-relative guards, env parsing).

Full repo: pnpm typecheck / lint / test all green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/planner/app/routes/new.tsx

@@ -3,6 +3,16 @@ import type { Route } from "./+types/new";
 import { createSession, initializeSessionWithWaypoints, initializeSessionWithNoGoAreas } from "~/lib/sessions";
 import { parseGpxAsync, extractWaypoints } from "@trails-cool/gpx";
 import { checkRateLimit } from "~/lib/rate-limit";
+import {
+  validateFetchUrl,
+  validateRedirectUrl,
+  getCallbackAllowedHosts,
+} from "~/lib/url-validation.server";
+
+// Query-param hard caps so an attacker can't shovel multi-MB strings
+// into our URL parser / session-storage path.
+const MAX_GPX_QUERY_LEN = 2_000_000; // GPX intentionally allowed to be large (full route)
+const MAX_URL_PARAM_LEN = 2048;
 
 export async function loader({ request }: Route.LoaderArgs) {
   const url = new URL(request.url);
@@ -25,6 +35,31 @@ export async function loader({ request }: Route.LoaderArgs) {
   const returnUrl = url.searchParams.get("returnUrl");
   const gpxEncoded = url.searchParams.get("gpx");
 
+  // Validate the callback URL — it will be used as a fetch target on
+  // save-to-journal. Reject non-http(s) schemes (no `file:` / `javascript:`),
+  // and if PLANNER_CALLBACK_ALLOWED_HOSTS is set, restrict to those hosts.
+  if (callbackUrl) {
+    const v = validateFetchUrl(callbackUrl, {
+      allowedHosts: getCallbackAllowedHosts(),
+      maxLength: MAX_URL_PARAM_LEN,
+    });
+    if (!v.ok) {
+      throw data({ error: `Invalid callback URL: ${v.reason}` }, { status: 400 });
+    }
+  }
+  if (token && token.length > MAX_URL_PARAM_LEN) {
+    throw data({ error: "callback token too long" }, { status: 400 });
+  }
+  if (returnUrl) {
+    const v = validateRedirectUrl(returnUrl, { maxLength: MAX_URL_PARAM_LEN });
+    if (!v.ok) {
+      throw data({ error: `Invalid returnUrl: ${v.reason}` }, { status: 400 });
+    }
+  }
+  if (gpxEncoded && gpxEncoded.length > MAX_GPX_QUERY_LEN) {
+    throw data({ error: "GPX payload too large" }, { status: 413 });
+  }
+
   // Create a session with callback info
   const session = await createSession({
     callbackUrl: callbackUrl ?? undefined,

apps/planner/app/routes/session.$id.tsx

@@ -28,21 +28,47 @@ export async function loader({ params }: Route.LoaderArgs) {
   });
 }
 
+// URL-param caps prevent a hostile link from feeding multi-MB JSON
+// into JSON.parse on the client (and from there into the Yjs doc).
+// Picked generously enough to accept realistic multi-day routes
+// (~hundreds of waypoints) but small enough to refuse abuse.
+const MAX_WAYPOINTS_LEN = 50_000;
+const MAX_NOGO_LEN = 50_000;
+const MAX_NOTES_LEN = 10_000;
+const MAX_RETURN_URL_LEN = 2048;
+
+function safeParseJson<T>(raw: string, maxLen: number): T | undefined {
+  if (raw.length > maxLen) return undefined;
+  try { return JSON.parse(raw) as T; } catch { return undefined; }
+}
+
+function safeReturnUrl(raw: string | null): string | undefined {
+  if (!raw || raw.length > MAX_RETURN_URL_LEN) return undefined;
+  // Same-origin relative path or http(s) absolute URL only. Rejects
+  // `javascript:` and protocol-relative `//host` so the value is safe
+  // to drop into an `<a href>`.
+  if (raw.startsWith("/") && !raw.startsWith("//")) return raw;
+  try {
+    const parsed = new URL(raw);
+    if (parsed.protocol === "http:" || parsed.protocol === "https:") return raw;
+  } catch { /* fall through */ }
+  return undefined;
+}
+
 export default function SessionPage({ loaderData }: Route.ComponentProps) {
   const { id } = useParams();
   const [searchParams] = useSearchParams();
-  const returnUrl = searchParams.get("returnUrl") ?? undefined;
+  const returnUrl = safeReturnUrl(searchParams.get("returnUrl"));
   const waypointsParam = searchParams.get("waypoints");
-  let initialWaypoints: Array<{ lat: number; lon: number; name?: string; isDayBreak?: boolean }> | undefined;
-  if (waypointsParam) {
-    try { initialWaypoints = JSON.parse(waypointsParam); } catch { /* ignore */ }
-  }
+  const initialWaypoints = waypointsParam
+    ? safeParseJson<Array<{ lat: number; lon: number; name?: string; isDayBreak?: boolean }>>(waypointsParam, MAX_WAYPOINTS_LEN)
+    : undefined;
   const noGoParam = searchParams.get("noGoAreas");
-  let initialNoGoAreas: Array<{ points: Array<{ lat: number; lon: number }> }> | undefined;
-  if (noGoParam) {
-    try { initialNoGoAreas = JSON.parse(noGoParam); } catch { /* ignore */ }
-  }
-  const initialNotes = searchParams.get("notes") ?? undefined;
+  const initialNoGoAreas = noGoParam
+    ? safeParseJson<Array<{ points: Array<{ lat: number; lon: number }> }>>(noGoParam, MAX_NOGO_LEN)
+    : undefined;
+  const notesRaw = searchParams.get("notes");
+  const initialNotes = notesRaw && notesRaw.length <= MAX_NOTES_LEN ? notesRaw : undefined;
 
   return (
     <div className="flex h-full flex-col">