fix(security): close open-redirect bypass and integer truncation from CodeQL

sanitizeReturnTo now rejects backslash in second position (browsers treat
/\host as scheme-relative). mapUint16 replaces unsafe uint32->uint16 cast
for prefix idle-timeout, rejecting out-of-range values at parse time.

Author: thomas-mangin

internal/component/bgp/reactor/config.go

@@ -609,8 +609,8 @@ func parsePrefixLimitFromFamily(familyKey string, entryMap map[string]any, ps *P
 		ps.PrefixTeardown = v != valFalse
 	}
 
-	if v, ok := mapUint32(prefixMap, "idle-timeout"); ok {
-		ps.PrefixIdleTimeout = uint16(v) //nolint:gosec // Bounded by YANG uint16 range
+	if v, ok := mapUint16(prefixMap, "idle-timeout"); ok {
+		ps.PrefixIdleTimeout = v
 	}
 
 	if v, ok := mapString(prefixMap, "updated"); ok {
@@ -826,6 +826,19 @@ func mapUint8(m map[string]any, key string) (uint8, bool) {
 	return uint8(n), true
 }
 
+// mapUint16 extracts a uint16 value from a map (stored as string).
+func mapUint16(m map[string]any, key string) (uint16, bool) {
+	s, ok := mapString(m, key)
+	if !ok {
+		return 0, false
+	}
+	n, err := strconv.ParseUint(s, 10, 16)
+	if err != nil {
+		return 0, false
+	}
+	return uint16(n), true
+}
+
 // mapMap extracts a nested map from a map.
 func mapMap(m map[string]any, key string) (map[string]any, bool) {
 	v, ok := m[key]

internal/component/web/auth.go

@@ -272,7 +272,7 @@ func LoginHandler(store *SessionStore, authenticator authz.Authenticator, loginR
 // Only same-origin paths starting with "/" are accepted; everything else
 // falls back to "/".
 func sanitizeReturnTo(raw string) string {
-	if raw == "" || raw[0] != '/' || strings.HasPrefix(raw, "//") {
+	if raw == "" || raw[0] != '/' || strings.HasPrefix(raw, "//") || (len(raw) > 1 && raw[1] == '\\') {
 		return "/"
 	}
 	return raw