@remix-run/router 1.23.1-pre-v6.0 → 1.23.2-pre-v6.0

package/dist/router.umd.js

@@ -1,5 +1,5 @@
 /**
- * @remix-run/router v1.23.1-pre-v6.0
+ * @remix-run/router v1.23.2-pre-v6.0
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -2533,7 +2533,7 @@
           // If the user didn't explicity indicate replace behavior, replace if
           // we redirected to the exact same location we're currently at to avoid
           // double back-buttons
-          let location = normalizeRedirectLocation(result.response.headers.get("Location"), new URL(request.url), basename);
+          let location = normalizeRedirectLocation(result.response.headers.get("Location"), new URL(request.url), basename, init.history);
           replace = location === state.location.pathname + state.location.search;
         }
         await startRedirectNavigation(request, result, true, {
@@ -3173,7 +3173,7 @@
       }
       let location = redirect.response.headers.get("Location");
       invariant(location, "Expected a Location header on the redirect Response");
-      location = normalizeRedirectLocation(location, new URL(request.url), basename);
+      location = normalizeRedirectLocation(location, new URL(request.url), basename, init.history);
       let redirectLocation = createLocation(state.location, location, {
         _isRedirect: true
       });
@@ -4956,16 +4956,30 @@
     }
     return response;
   }
-  function normalizeRedirectLocation(location, currentUrl, basename) {
+  function normalizeRedirectLocation(location, currentUrl, basename, historyInstance) {
+    // Match Chrome's behavior:
+    // https://github.com/chromium/chromium/blob/216dbeb61db0c667e62082e5f5400a32d6983df3/content/public/common/url_utils.cc#L82
+    let invalidProtocols = ["about:", "blob:", "chrome:", "chrome-untrusted:", "content:", "data:", "devtools:", "file:", "filesystem:",
+    // eslint-disable-next-line no-script-url
+    "javascript:"];
     if (ABSOLUTE_URL_REGEX.test(location)) {
       // Strip off the protocol+origin for same-origin + same-basename absolute redirects
       let normalizedLocation = location;
       let url = normalizedLocation.startsWith("//") ? new URL(currentUrl.protocol + normalizedLocation) : new URL(normalizedLocation);
+      if (invalidProtocols.includes(url.protocol)) {
+        throw new Error("Invalid redirect location");
+      }
       let isSameBasename = stripBasename(url.pathname, basename) != null;
       if (url.origin === currentUrl.origin && isSameBasename) {
         return url.pathname + url.search + url.hash;
       }
     }
+    try {
+      let url = historyInstance.createURL(location);
+      if (invalidProtocols.includes(url.protocol)) {
+        throw new Error("Invalid redirect location");
+      }
+    } catch (e) {}
     return location;
   }