@prismicio/svelte 3.0.0-pr.71.08694b9 → 3.0.0-pr.71.35fb12f

package/dist/kit/redirectToPreviewURL.js

@@ -1,5 +1,6 @@
 import { resolve } from "$app/paths";
 import * as prismic from "@prismicio/client";
+import { getSafePath } from "../lib/getSafePath";
 /**
  * Redirects a visitor to the URL of a previewed Prismic document from within a SvelteKit `+server`
  * file.
@@ -58,22 +59,13 @@ export const redirectToPreviewURL = async (config) => {
  * if it is missing or not a path on this website.
  */
 const getSharedPath = (requestURL, routePrefix) => {
-    const path = new URL(requestURL).searchParams.get("path");
-    if (!path?.startsWith("/")) {
-        return;
-    }
-    // Paths like `//evil.com` and `/\evil.com` resolve to another origin.
-    const origin = "https://placeholder.invalid";
-    const url = new URL(path, origin);
+    const path = getSafePath(new URL(requestURL).searchParams.get("path"));
     // `path` comes from the browser, so it already includes `paths.base`. `resolve()` returns `base`
     // either absolute or relative to the request.
     const base = new URL(resolve("/", {}), requestURL).pathname.slice(0, -1);
-    if (url.origin !== origin || !url.pathname.startsWith(`${base}/`)) {
+    if (!path?.startsWith(`${base}/`)) {
         return;
     }
-    const pathname = url.pathname.slice(base.length);
-    if (pathname !== `/${routePrefix}` && !pathname.startsWith(`/${routePrefix}/`)) {
-        url.pathname = `${base}/${routePrefix}${pathname}`;
-    }
-    return url.pathname + url.search + url.hash;
+    const pathname = path.slice(base.length);
+    return pathname.split(/[/?#]/)[1] === routePrefix ? path : `${base}/${routePrefix}${pathname}`;
 };

package/dist/lib/getSafePath.d.ts

@@ -0,0 +1,2 @@
+/** Returns `path` if it stays on the current origin, like `/blog?page=2#top`. */
+export declare function getSafePath(path: string | null | undefined): string | undefined;

package/dist/lib/getSafePath.js

@@ -0,0 +1,11 @@
+/** Returns `path` if it stays on the current origin, like `/blog?page=2#top`. */
+export function getSafePath(path) {
+    if (!path?.startsWith("/") || path.startsWith("//") || path.startsWith("/\\")) {
+        return;
+    }
+    const origin = "https://placeholder.invalid";
+    const url = new URL(path, origin);
+    if (url.origin === origin) {
+        return url.href.slice(origin.length);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@prismicio/svelte",
-	"version": "3.0.0-pr.71.08694b9",
+	"version": "3.0.0-pr.71.35fb12f",
 	"description": "Svelte components to present Prismic content.",
 	"keywords": [
 		"prismic",

package/src/kit/redirectToPreviewURL.ts

@@ -2,6 +2,8 @@ import { resolve } from "$app/paths"
 import * as prismic from "@prismicio/client"
 import type { Cookies } from "@sveltejs/kit"
 
+import { getSafePath } from "../lib/getSafePath"
+
 export type RedirectToPreviewURLConfig = {
 	/** The Prismic client configured for the preview session's repository. */
 	// `Pick` is used to use the smallest possible subset of
@@ -96,25 +98,15 @@ export const redirectToPreviewURL = async (
  * if it is missing or not a path on this website.
  */
 const getSharedPath = (requestURL: string, routePrefix: string): string | undefined => {
-	const path = new URL(requestURL).searchParams.get("path")
-	if (!path?.startsWith("/")) {
-		return
-	}
-
-	// Paths like `//evil.com` and `/\evil.com` resolve to another origin.
-	const origin = "https://placeholder.invalid"
-	const url = new URL(path, origin)
+	const path = getSafePath(new URL(requestURL).searchParams.get("path"))
 	// `path` comes from the browser, so it already includes `paths.base`. `resolve()` returns `base`
 	// either absolute or relative to the request.
 	const base = new URL(resolve("/", {}), requestURL).pathname.slice(0, -1)
-	if (url.origin !== origin || !url.pathname.startsWith(`${base}/`)) {
+	if (!path?.startsWith(`${base}/`)) {
 		return
 	}
 
-	const pathname = url.pathname.slice(base.length)
-	if (pathname !== `/${routePrefix}` && !pathname.startsWith(`/${routePrefix}/`)) {
-		url.pathname = `${base}/${routePrefix}${pathname}`
-	}
+	const pathname = path.slice(base.length)
 
-	return url.pathname + url.search + url.hash
+	return pathname.split(/[/?#]/)[1] === routePrefix ? path : `${base}/${routePrefix}${pathname}`
 }

package/src/lib/getSafePath.ts

@@ -0,0 +1,12 @@
+/** Returns `path` if it stays on the current origin, like `/blog?page=2#top`. */
+export function getSafePath(path: string | null | undefined): string | undefined {
+	if (!path?.startsWith("/") || path.startsWith("//") || path.startsWith("/\\")) {
+		return
+	}
+
+	const origin = "https://placeholder.invalid"
+	const url = new URL(path, origin)
+	if (url.origin === origin) {
+		return url.href.slice(origin.length)
+	}
+}