bosia 0.1.3 → 0.1.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bosia",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "type": "module",
   "description": "A fast, batteries-included fullstack framework — SSR · Svelte 5 Runes · Bun · ElysiaJS. File-based routing inspired by SvelteKit. No Node.js, no Vite, no adapters.",
   "keywords": [

package/src/core/errors.ts

@@ -8,8 +8,55 @@ export class HttpError extends Error {
     }
 }
 
+export interface RedirectOptions {
+    /** Set to `true` to allow redirects to external origins (e.g. OAuth providers). */
+    allowExternal?: boolean;
+}
+
 export class Redirect {
-    constructor(public status: number, public location: string) {}
+    constructor(
+        public status: number,
+        public location: string,
+        options?: RedirectOptions,
+    ) {
+        validateRedirectLocation(location, options);
+    }
+}
+
+const DANGEROUS_SCHEMES = /^(javascript|data|vbscript):/i;
+
+function validateRedirectLocation(
+    location: string,
+    options?: RedirectOptions,
+): void {
+    if (options?.allowExternal) return;
+
+    const trimmed = location.trim();
+
+    // Reject dangerous schemes
+    if (DANGEROUS_SCHEMES.test(trimmed)) {
+        throw new Error(
+            `redirect(): dangerous scheme in URL "${location}". ` +
+                `Only relative paths and same-origin URLs are allowed.`,
+        );
+    }
+
+    // Reject protocol-relative URLs (//evil.com)
+    if (trimmed.startsWith("//")) {
+        throw new Error(
+            `redirect(): protocol-relative URLs like "${location}" are not allowed. ` +
+                `Use a relative path or pass { allowExternal: true } for external redirects.`,
+        );
+    }
+
+    // Allow relative paths (no scheme)
+    if (!/^[a-zA-Z][a-zA-Z0-9+\-.]*:/.test(trimmed)) return;
+
+    // It's an absolute URL — reject external origins
+    throw new Error(
+        `redirect(): external URL "${location}" is not allowed. ` +
+            `Use a relative path or pass { allowExternal: true } for external redirects.`,
+    );
 }
 
 /** Throw an HTTP error from a load() function. */
@@ -18,8 +65,12 @@ export function error(status: number, message: string): never {
 }
 
 /** Redirect the user from a load() function. */
-export function redirect(status: number, location: string): never {
-    throw new Redirect(status, location);
+export function redirect(
+    status: number,
+    location: string,
+    options?: RedirectOptions,
+): never {
+    throw new Redirect(status, location, options);
 }
 
 // ─── Form Action Helpers ─────────────────────────────────

package/src/lib/index.ts

@@ -6,7 +6,7 @@
 export { cn, getServerTime } from "./utils.ts";
 export { sequence } from "../core/hooks.ts";
 export { error, redirect, fail } from "../core/errors.ts";
-export type { HttpError, Redirect, ActionFailure } from "../core/errors.ts";
+export type { HttpError, Redirect, RedirectOptions, ActionFailure } from "../core/errors.ts";
 export type {
     RequestEvent,
     LoadEvent,