fix(eco): Improves domain checking for next URL in installation flow (#113118)

Author: GabeVillalobos

static/app/components/backendJsonFormAdapter/projectMapperAdapter.spec.tsx

@@ -369,7 +369,10 @@ describe('ProjectMapperAdapter', () => {
         {
           organization: org,
           initialRouterConfig: {
-            location: {pathname: '/', query: {next: 'https://evil.com/steal'}},
+            location: {
+              pathname: '/',
+              query: {next: 'https://vercel.com.evil.example.com/steal'},
+            },
           },
         }
       );

static/app/components/backendJsonFormAdapter/projectMapperAdapter.tsx

@@ -244,8 +244,15 @@ export function ProjectMapperNextButton({config, value}: ProjectMapperNextButton
     return null;
   }
 
-  if (!nextUrl.startsWith(nextButton.allowedDomain)) {
-    Sentry.captureMessage(`Got invalid next url: ${nextUrl}`);
+  try {
+    const parsedUrl = new URL(nextUrl);
+    const allowedOrigin = new URL(nextButton.allowedDomain).origin;
+    if (parsedUrl.origin !== allowedOrigin) {
+      Sentry.captureMessage(`Got invalid next url: ${nextUrl}`);
+      return null;
+    }
+  } catch {
+    Sentry.captureMessage(`Failed to parse next url: ${nextUrl}`);
     return null;
   }