@prismicio/svelte 3.0.0-pr.71.949ea7f → 3.0.0-pr.71.98fd16f

package/dist/lib/getSafePath.d.ts

@@ -1,2 +1,5 @@
-/** Returns `path` if it stays on the current origin, like `/blog?page=2#top`. */
+/**
+ * Returns `path` if it stays on the current origin, like `/blog?page=2#top`. It comes from
+ * `location`, so it already includes `paths.base`.
+ */
 export declare function getSafePath(path: string | null | undefined): string | undefined;

package/dist/lib/getSafePath.js

@@ -1,11 +1,22 @@
-/** Returns `path` if it stays on the current origin, like `/blog?page=2#top`. */
+/**
+ * Returns `path` if it stays on the current origin, like `/blog?page=2#top`. It comes from
+ * `location`, so it already includes `paths.base`.
+ */
 export function getSafePath(path) {
     if (!path?.startsWith("/") || path.startsWith("//") || path.startsWith("/\\")) {
         return;
     }
     const origin = "https://placeholder.invalid";
-    const url = new URL(path, origin);
-    if (url.origin === origin) {
-        return url.href.slice(origin.length);
+    let url;
+    try {
+        url = new URL(path, origin);
+    }
+    catch {
+        return;
+    }
+    const safePath = url.href.slice(origin.length);
+    // Normalizing can create `//`, like with `/.//example.com`.
+    if (url.origin === origin && !safePath.startsWith("//")) {
+        return safePath;
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@prismicio/svelte",
-	"version": "3.0.0-pr.71.949ea7f",
+	"version": "3.0.0-pr.71.98fd16f",
 	"description": "Svelte components to present Prismic content.",
 	"keywords": [
 		"prismic",

package/src/lib/getSafePath.ts

@@ -1,12 +1,22 @@
-/** Returns `path` if it stays on the current origin, like `/blog?page=2#top`. */
+/**
+ * Returns `path` if it stays on the current origin, like `/blog?page=2#top`. It comes from
+ * `location`, so it already includes `paths.base`.
+ */
 export function getSafePath(path: string | null | undefined): string | undefined {
 	if (!path?.startsWith("/") || path.startsWith("//") || path.startsWith("/\\")) {
 		return
 	}
 
 	const origin = "https://placeholder.invalid"
-	const url = new URL(path, origin)
-	if (url.origin === origin) {
-		return url.href.slice(origin.length)
+	let url: URL
+	try {
+		url = new URL(path, origin)
+	} catch {
+		return
+	}
+	const safePath = url.href.slice(origin.length)
+	// Normalizing can create `//`, like with `/.//example.com`.
+	if (url.origin === origin && !safePath.startsWith("//")) {
+		return safePath
 	}
 }