@tanstack/react-router 1.159.14 → 1.160.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/src/link.tsx CHANGED
@@ -118,7 +118,7 @@ export function useLinkProps<
118
118
  ) {
119
119
  try {
120
120
  new URL(to)
121
- if (isDangerousProtocol(to)) {
121
+ if (isDangerousProtocol(to, router.protocolAllowlist)) {
122
122
  if (process.env.NODE_ENV !== 'production') {
123
123
  console.warn(`Blocked Link with dangerous protocol: ${to}`)
124
124
  }
@@ -170,7 +170,7 @@ export function useLinkProps<
170
170
 
171
171
  const externalLink = (() => {
172
172
  if (hrefOption?.external) {
173
- if (isDangerousProtocol(hrefOption.href)) {
173
+ if (isDangerousProtocol(hrefOption.href, router.protocolAllowlist)) {
174
174
  if (process.env.NODE_ENV !== 'production') {
175
175
  console.warn(
176
176
  `Blocked Link with dangerous protocol: ${hrefOption.href}`,
@@ -187,7 +187,7 @@ export function useLinkProps<
187
187
  if (typeof to === 'string' && to.indexOf(':') > -1) {
188
188
  try {
189
189
  new URL(to)
190
- if (isDangerousProtocol(to)) {
190
+ if (isDangerousProtocol(to, router.protocolAllowlist)) {
191
191
  if (process.env.NODE_ENV !== 'production') {
192
192
  console.warn(`Blocked Link with dangerous protocol: ${to}`)
193
193
  }
@@ -438,7 +438,7 @@ export function useLinkProps<
438
438
  const externalLink = React.useMemo(() => {
439
439
  if (hrefOption?.external) {
440
440
  // Block dangerous protocols for external links
441
- if (isDangerousProtocol(hrefOption.href)) {
441
+ if (isDangerousProtocol(hrefOption.href, router.protocolAllowlist)) {
442
442
  if (process.env.NODE_ENV !== 'production') {
443
443
  console.warn(
444
444
  `Blocked Link with dangerous protocol: ${hrefOption.href}`,
@@ -453,8 +453,8 @@ export function useLinkProps<
453
453
  if (typeof to !== 'string' || to.indexOf(':') === -1) return undefined
454
454
  try {
455
455
  new URL(to as any)
456
- // Block dangerous protocols like javascript:, data:, vbscript:
457
- if (isDangerousProtocol(to)) {
456
+ // Block dangerous protocols like javascript:, blob:, data:
457
+ if (isDangerousProtocol(to, router.protocolAllowlist)) {
458
458
  if (process.env.NODE_ENV !== 'production') {
459
459
  console.warn(`Blocked Link with dangerous protocol: ${to}`)
460
460
  }
@@ -463,7 +463,7 @@ export function useLinkProps<
463
463
  return to
464
464
  } catch {}
465
465
  return undefined
466
- }, [to, hrefOption])
466
+ }, [to, hrefOption, router.protocolAllowlist])
467
467
 
468
468
  // eslint-disable-next-line react-hooks/rules-of-hooks
469
469
  const isActive = useRouterState({