security: harden namespace handling in legacy bitstream redirect guard

Author: Paurikova2

src/app/bitstream-page/legacy-bitstream-url-redirect.guard.ts

@@ -48,9 +48,15 @@ export const legacyBitstreamURLRedirectGuard: CanActivateFn = (
     getFirstCompletedRemoteData(),
     map((rd: RemoteData<Bitstream>) => {
       if (rd.hasSucceeded && !rd.hasNoContent) {
-        const nameSpace = appConfig.ui.nameSpace?.replace(/\/$/, '') || '';
-        const redirectUrl = new URL(nameSpace + `/bitstreams/${rd.payload.uuid}/download`, serverHardRedirectService.getCurrentOrigin()).href;
-        console.log('Legacy bitstream URL redirecting to:', redirectUrl);
+        // Harden namespace handling: trim slashes, neutralize absolute-like values, enforce root-relative path
+        let nameSpace = (appConfig.ui.nameSpace || '').replace(/^\/+|\/+$/g, '');
+        // Neutralize any absolute-like values (http:, https:, //)
+        if (nameSpace.startsWith('http:') || nameSpace.startsWith('https:') || nameSpace.startsWith('//')) {
+          nameSpace = '';
+        }
+        // Always build path starting with /
+        const redirectPath = nameSpace ? `/${nameSpace}/bitstreams/${rd.payload.uuid}/download` : `/bitstreams/${rd.payload.uuid}/download`;
+        const redirectUrl = new URL(redirectPath, serverHardRedirectService.getCurrentOrigin()).href;
         serverHardRedirectService.redirect(redirectUrl, 301);
         return false;
       } else {