Validate OAuth login redirects before using them in headers #124

The login_uri query parameter is validated to start with / and not //, but is not checked for CRLF sequences, null bytes, or other header-injection characters before being stored in pending_states and later interpolated into the Refresh HTTP response header. While the ASGI server (Hypercorn) sanitizes header values as a secondary defense, the framework itself does not validate this value for the specific context in which it is used (an HTTP header).

Data flow: quart.request.args.get("login") → prefix validation (only) → stored in pending_states → interpolated into Refresh header → response

Attacker capability required: Remote unauthenticated user (can initiate an OAuth login flow with a crafted login parameter).

Impact on success: In the default deployment, Hypercorn rejects CRLF in header values, so no actual header injection occurs. This is a defense-in-depth gap: if the ASGI server were changed or misconfigured, the unsanitized value could enable HTTP response splitting.