@prismicio/svelte 3.0.0-pr.71.08694b9 → 3.0.0-pr.71.249fd8d

package/dist/kit/PrismicPreview.svelte

@@ -19,20 +19,9 @@
 		 * Only set this value if the route parameter's name differs from the parameter's value.
 		 */
 		routePrefixName?: string
-
-		/**
-		 * The URL of your preview route, such as `/api/preview`. The Prismic Toolbar uses it to create
-		 * share links, and hides its Share button without it.
-		 */
-		previewURL?: string
 	}
 
-	const {
-		repositoryName,
-		routePrefix = "preview",
-		routePrefixName = routePrefix,
-		previewURL,
-	}: Props = $props()
+	const { repositoryName, routePrefix = "preview", routePrefixName = routePrefix }: Props = $props()
 
 	const toolbarSrc = $derived(getToolbarSrc(repositoryName, { version: 5 }))
 
@@ -100,5 +89,5 @@
 </script>
 
 <svelte:head>
-	<script defer src={toolbarSrc} data-preview-url={previewURL}></script>
+	<script defer src={toolbarSrc}></script>
 </svelte:head>

package/dist/kit/PrismicPreview.svelte.d.ts

@@ -12,11 +12,6 @@ type Props = {
      * Only set this value if the route parameter's name differs from the parameter's value.
      */
     routePrefixName?: string;
-    /**
-     * The URL of your preview route, such as `/api/preview`. The Prismic Toolbar uses it to create
-     * share links, and hides its Share button without it.
-     */
-    previewURL?: string;
 };
 declare const PrismicPreview: import("svelte").Component<Props, {}, "">;
 type PrismicPreview = ReturnType<typeof PrismicPreview>;

package/dist/kit/redirectToPreviewURL.js

@@ -1,5 +1,6 @@
 import { resolve } from "$app/paths";
 import * as prismic from "@prismicio/client";
+import { getSafePath } from "../lib/getSafePath";
 /**
  * Redirects a visitor to the URL of a previewed Prismic document from within a SvelteKit `+server`
  * file.
@@ -58,22 +59,14 @@ export const redirectToPreviewURL = async (config) => {
  * if it is missing or not a path on this website.
  */
 const getSharedPath = (requestURL, routePrefix) => {
-    const path = new URL(requestURL).searchParams.get("path");
-    if (!path?.startsWith("/")) {
-        return;
-    }
-    // Paths like `//evil.com` and `/\evil.com` resolve to another origin.
-    const origin = "https://placeholder.invalid";
-    const url = new URL(path, origin);
+    const path = getSafePath(new URL(requestURL).searchParams.get("path"));
     // `path` comes from the browser, so it already includes `paths.base`. `resolve()` returns `base`
     // either absolute or relative to the request.
     const base = new URL(resolve("/", {}), requestURL).pathname.slice(0, -1);
-    if (url.origin !== origin || !url.pathname.startsWith(`${base}/`)) {
+    const rest = path?.startsWith(base) ? path.slice(base.length) : undefined;
+    // `/docs` and `/docs?q=1` are under the `/docs` base, but `/docs-old` isn't.
+    if (rest === undefined || !/^([/?#]|$)/.test(rest)) {
         return;
     }
-    const pathname = url.pathname.slice(base.length);
-    if (pathname !== `/${routePrefix}` && !pathname.startsWith(`/${routePrefix}/`)) {
-        url.pathname = `${base}/${routePrefix}${pathname}`;
-    }
-    return url.pathname + url.search + url.hash;
+    return /^\/([^/?#]*)/.exec(rest)?.[1] === routePrefix ? path : `${base}/${routePrefix}${rest}`;
 };

package/dist/lib/getSafePath.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Returns `path` if it stays on the current origin, like `/blog?page=2#top`. It comes from
+ * `location`, so it already includes `paths.base`.
+ */
+export declare function getSafePath(path: string | null | undefined): string | undefined;

package/dist/lib/getSafePath.js

@@ -0,0 +1,22 @@
+/**
+ * Returns `path` if it stays on the current origin, like `/blog?page=2#top`. It comes from
+ * `location`, so it already includes `paths.base`.
+ */
+export function getSafePath(path) {
+    if (!path?.startsWith("/") || path.startsWith("//") || path.startsWith("/\\")) {
+        return;
+    }
+    const origin = "https://placeholder.invalid";
+    let url;
+    try {
+        url = new URL(path, origin);
+    }
+    catch {
+        return;
+    }
+    const safePath = url.href.slice(origin.length);
+    // Normalizing can create `//`, like with `/.//example.com`.
+    if (url.origin === origin && !safePath.startsWith("//")) {
+        return safePath;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@prismicio/svelte",
-	"version": "3.0.0-pr.71.08694b9",
+	"version": "3.0.0-pr.71.249fd8d",
 	"description": "Svelte components to present Prismic content.",
 	"keywords": [
 		"prismic",
@@ -62,7 +62,7 @@
 		"esm-env": "^1.2.2"
 	},
 	"devDependencies": {
-		"@prismicio/client": "7.22.3-pr.477.9eb2102",
+		"@prismicio/client": "^7.23.0",
 		"@prismicio/mock": "^0.7.2",
 		"@sveltejs/kit": "^3.0.1",
 		"@sveltejs/package": "^3.0.1",
@@ -71,7 +71,7 @@
 		"@types/node": "^26.6.5",
 		"@vitest/coverage-v8": "^5.0.5",
 		"globals": "^17.13.0",
-		"happy-dom": "^21.0.3",
+		"happy-dom": "^21.0.4",
 		"oxfmt": "^0.74.0",
 		"oxlint": "^1.89.0",
 		"standard-version": "^9.5.0",
@@ -89,9 +89,6 @@
 			"optional": true
 		}
 	},
-	"overrides": {
-		"@prismicio/client": "$@prismicio/client"
-	},
 	"engines": {
 		"node": ">=22"
 	}

package/src/kit/PrismicPreview.svelte

@@ -19,20 +19,9 @@
 		 * Only set this value if the route parameter's name differs from the parameter's value.
 		 */
 		routePrefixName?: string
-
-		/**
-		 * The URL of your preview route, such as `/api/preview`. The Prismic Toolbar uses it to create
-		 * share links, and hides its Share button without it.
-		 */
-		previewURL?: string
 	}
 
-	const {
-		repositoryName,
-		routePrefix = "preview",
-		routePrefixName = routePrefix,
-		previewURL,
-	}: Props = $props()
+	const { repositoryName, routePrefix = "preview", routePrefixName = routePrefix }: Props = $props()
 
 	const toolbarSrc = $derived(getToolbarSrc(repositoryName, { version: 5 }))
 
@@ -100,5 +89,5 @@
 </script>
 
 <svelte:head>
-	<script defer src={toolbarSrc} data-preview-url={previewURL}></script>
+	<script defer src={toolbarSrc}></script>
 </svelte:head>

package/src/kit/redirectToPreviewURL.ts

@@ -2,6 +2,8 @@ import { resolve } from "$app/paths"
 import * as prismic from "@prismicio/client"
 import type { Cookies } from "@sveltejs/kit"
 
+import { getSafePath } from "../lib/getSafePath"
+
 export type RedirectToPreviewURLConfig = {
 	/** The Prismic client configured for the preview session's repository. */
 	// `Pick` is used to use the smallest possible subset of
@@ -96,25 +98,15 @@ export const redirectToPreviewURL = async (
  * if it is missing or not a path on this website.
  */
 const getSharedPath = (requestURL: string, routePrefix: string): string | undefined => {
-	const path = new URL(requestURL).searchParams.get("path")
-	if (!path?.startsWith("/")) {
-		return
-	}
-
-	// Paths like `//evil.com` and `/\evil.com` resolve to another origin.
-	const origin = "https://placeholder.invalid"
-	const url = new URL(path, origin)
+	const path = getSafePath(new URL(requestURL).searchParams.get("path"))
 	// `path` comes from the browser, so it already includes `paths.base`. `resolve()` returns `base`
 	// either absolute or relative to the request.
 	const base = new URL(resolve("/", {}), requestURL).pathname.slice(0, -1)
-	if (url.origin !== origin || !url.pathname.startsWith(`${base}/`)) {
+	const rest = path?.startsWith(base) ? path.slice(base.length) : undefined
+	// `/docs` and `/docs?q=1` are under the `/docs` base, but `/docs-old` isn't.
+	if (rest === undefined || !/^([/?#]|$)/.test(rest)) {
 		return
 	}
 
-	const pathname = url.pathname.slice(base.length)
-	if (pathname !== `/${routePrefix}` && !pathname.startsWith(`/${routePrefix}/`)) {
-		url.pathname = `${base}/${routePrefix}${pathname}`
-	}
-
-	return url.pathname + url.search + url.hash
+	return /^\/([^/?#]*)/.exec(rest)?.[1] === routePrefix ? path : `${base}/${routePrefix}${rest}`
 }

package/src/lib/getSafePath.ts

@@ -0,0 +1,22 @@
+/**
+ * Returns `path` if it stays on the current origin, like `/blog?page=2#top`. It comes from
+ * `location`, so it already includes `paths.base`.
+ */
+export function getSafePath(path: string | null | undefined): string | undefined {
+	if (!path?.startsWith("/") || path.startsWith("//") || path.startsWith("/\\")) {
+		return
+	}
+
+	const origin = "https://placeholder.invalid"
+	let url: URL
+	try {
+		url = new URL(path, origin)
+	} catch {
+		return
+	}
+	const safePath = url.href.slice(origin.length)
+	// Normalizing can create `//`, like with `/.//example.com`.
+	if (url.origin === origin && !safePath.startsWith("//")) {
+		return safePath
+	}
+}