payload 3.87.1 → 3.88.0

package/dist/utilities/getSafeRedirect.js

@@ -2,23 +2,30 @@ export const getSafeRedirect = ({ allowAbsoluteUrls = false, fallbackTo = '/', r
     if (typeof redirectTo !== 'string') {
         return fallbackTo;
     }
-    // Normalize and decode the path
-    let redirectPath;
+    const redirectPath = redirectTo.trim();
+    const hasControlCharacters = [
+        ...redirectPath
+    ].some((character)=>{
+        const code = character.charCodeAt(0);
+        return code <= 31 || code === 127;
+    });
+    const hasAmbiguousPathPrefix = /^\/%(?:25)*(?:09|0a|0d|2f|5c)/i.test(redirectPath);
+    let parsedRedirect;
     try {
-        redirectPath = decodeURIComponent(redirectTo.trim());
+        parsedRedirect = new URL(redirectPath, 'http://localhost');
     } catch  {
-        return fallbackTo // invalid encoding
-        ;
+        return fallbackTo;
     }
-    const isSafeRedirect = // Must start with a single forward slash (e.g., "/admin")
-    redirectPath.startsWith('/') && // Prevent protocol-relative URLs (e.g., "//example.com")
+    const isSafeRedirect = !hasControlCharacters && !hasAmbiguousPathPrefix && // Must start with a single forward slash (e.g., "/admin")
+    redirectPath.startsWith('/') && // Must resolve to the same origin after URL parser normalization
+    parsedRedirect.origin === 'http://localhost' && // Prevent protocol-relative URLs (e.g., "//example.com")
     !redirectPath.startsWith('//') && // Prevent encoded slashes that could resolve to protocol-relative
     !redirectPath.startsWith('/%2F') && // Prevent backslash-based escape attempts (e.g., "/\\/example.com", "/\\\\example.com", "/\\example.com")
     !redirectPath.startsWith('/\\/') && !redirectPath.startsWith('/\\\\') && !redirectPath.startsWith('/\\') && // Prevent javascript-based schemes (e.g., "/javascript:alert(1)")
     !redirectPath.toLowerCase().startsWith('/javascript:') && // Prevent attempts to redirect to full URLs using "/http:" or "/https:"
     !redirectPath.toLowerCase().startsWith('/http');
-    const isAbsoluteSafeRedirect = allowAbsoluteUrls && // Must be a valid absolute URL with http or https
-    /^https?:\/\/\S+$/i.test(redirectPath);
+    const isAbsoluteSafeRedirect = allowAbsoluteUrls && !hasControlCharacters && // Must be a valid absolute URL with http or https
+    /^https?:\/\/\S+$/i.test(redirectPath) && (parsedRedirect.protocol === 'http:' || parsedRedirect.protocol === 'https:');
     return isSafeRedirect || isAbsoluteSafeRedirect ? redirectPath : fallbackTo;
 };
 

package/dist/utilities/getSafeRedirect.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/getSafeRedirect.ts"],"sourcesContent":["export const getSafeRedirect = ({\n  allowAbsoluteUrls = false,\n  fallbackTo = '/',\n  redirectTo,\n}: {\n  allowAbsoluteUrls?: boolean\n  fallbackTo?: string\n  redirectTo: string | string[]\n}): string => {\n  if (typeof redirectTo !== 'string') {\n    return fallbackTo\n  }\n\n  // Normalize and decode the path\n  let redirectPath: string\n  try {\n    redirectPath = decodeURIComponent(redirectTo.trim())\n  } catch {\n    return fallbackTo // invalid encoding\n  }\n\n  const isSafeRedirect =\n    // Must start with a single forward slash (e.g., \"/admin\")\n    redirectPath.startsWith('/') &&\n    // Prevent protocol-relative URLs (e.g., \"//example.com\")\n    !redirectPath.startsWith('//') &&\n    // Prevent encoded slashes that could resolve to protocol-relative\n    !redirectPath.startsWith('/%2F') &&\n    // Prevent backslash-based escape attempts (e.g., \"/\\\\/example.com\", \"/\\\\\\\\example.com\", \"/\\\\example.com\")\n    !redirectPath.startsWith('/\\\\/') &&\n    !redirectPath.startsWith('/\\\\\\\\') &&\n    !redirectPath.startsWith('/\\\\') &&\n    // Prevent javascript-based schemes (e.g., \"/javascript:alert(1)\")\n    !redirectPath.toLowerCase().startsWith('/javascript:') &&\n    // Prevent attempts to redirect to full URLs using \"/http:\" or \"/https:\"\n    !redirectPath.toLowerCase().startsWith('/http')\n\n  const isAbsoluteSafeRedirect =\n    allowAbsoluteUrls &&\n    // Must be a valid absolute URL with http or https\n    /^https?:\\/\\/\\S+$/i.test(redirectPath)\n\n  return isSafeRedirect || isAbsoluteSafeRedirect ? redirectPath : fallbackTo\n}\n"],"names":["getSafeRedirect","allowAbsoluteUrls","fallbackTo","redirectTo","redirectPath","decodeURIComponent","trim","isSafeRedirect","startsWith","toLowerCase","isAbsoluteSafeRedirect","test"],"mappings":"AAAA,OAAO,MAAMA,kBAAkB,CAAC,EAC9BC,oBAAoB,KAAK,EACzBC,aAAa,GAAG,EAChBC,UAAU,EAKX;IACC,IAAI,OAAOA,eAAe,UAAU;QAClC,OAAOD;IACT;IAEA,gCAAgC;IAChC,IAAIE;IACJ,IAAI;QACFA,eAAeC,mBAAmBF,WAAWG,IAAI;IACnD,EAAE,OAAM;QACN,OAAOJ,WAAW,mBAAmB;;IACvC;IAEA,MAAMK,iBACJ,0DAA0D;IAC1DH,aAAaI,UAAU,CAAC,QACxB,yDAAyD;IACzD,CAACJ,aAAaI,UAAU,CAAC,SACzB,kEAAkE;IAClE,CAACJ,aAAaI,UAAU,CAAC,WACzB,0GAA0G;IAC1G,CAACJ,aAAaI,UAAU,CAAC,WACzB,CAACJ,aAAaI,UAAU,CAAC,YACzB,CAACJ,aAAaI,UAAU,CAAC,UACzB,kEAAkE;IAClE,CAACJ,aAAaK,WAAW,GAAGD,UAAU,CAAC,mBACvC,wEAAwE;IACxE,CAACJ,aAAaK,WAAW,GAAGD,UAAU,CAAC;IAEzC,MAAME,yBACJT,qBACA,kDAAkD;IAClD,oBAAoBU,IAAI,CAACP;IAE3B,OAAOG,kBAAkBG,yBAAyBN,eAAeF;AACnE,EAAC"}
+{"version":3,"sources":["../../src/utilities/getSafeRedirect.ts"],"sourcesContent":["export const getSafeRedirect = ({\n  allowAbsoluteUrls = false,\n  fallbackTo = '/',\n  redirectTo,\n}: {\n  allowAbsoluteUrls?: boolean\n  fallbackTo?: string\n  redirectTo: string | string[]\n}): string => {\n  if (typeof redirectTo !== 'string') {\n    return fallbackTo\n  }\n\n  const redirectPath = redirectTo.trim()\n\n  const hasControlCharacters = [...redirectPath].some((character) => {\n    const code = character.charCodeAt(0)\n    return code <= 31 || code === 127\n  })\n  const hasAmbiguousPathPrefix = /^\\/%(?:25)*(?:09|0a|0d|2f|5c)/i.test(redirectPath)\n\n  let parsedRedirect: URL\n  try {\n    parsedRedirect = new URL(redirectPath, 'http://localhost')\n  } catch {\n    return fallbackTo\n  }\n\n  const isSafeRedirect =\n    !hasControlCharacters &&\n    !hasAmbiguousPathPrefix &&\n    // Must start with a single forward slash (e.g., \"/admin\")\n    redirectPath.startsWith('/') &&\n    // Must resolve to the same origin after URL parser normalization\n    parsedRedirect.origin === 'http://localhost' &&\n    // Prevent protocol-relative URLs (e.g., \"//example.com\")\n    !redirectPath.startsWith('//') &&\n    // Prevent encoded slashes that could resolve to protocol-relative\n    !redirectPath.startsWith('/%2F') &&\n    // Prevent backslash-based escape attempts (e.g., \"/\\\\/example.com\", \"/\\\\\\\\example.com\", \"/\\\\example.com\")\n    !redirectPath.startsWith('/\\\\/') &&\n    !redirectPath.startsWith('/\\\\\\\\') &&\n    !redirectPath.startsWith('/\\\\') &&\n    // Prevent javascript-based schemes (e.g., \"/javascript:alert(1)\")\n    !redirectPath.toLowerCase().startsWith('/javascript:') &&\n    // Prevent attempts to redirect to full URLs using \"/http:\" or \"/https:\"\n    !redirectPath.toLowerCase().startsWith('/http')\n\n  const isAbsoluteSafeRedirect =\n    allowAbsoluteUrls &&\n    !hasControlCharacters &&\n    // Must be a valid absolute URL with http or https\n    /^https?:\\/\\/\\S+$/i.test(redirectPath) &&\n    (parsedRedirect.protocol === 'http:' || parsedRedirect.protocol === 'https:')\n\n  return isSafeRedirect || isAbsoluteSafeRedirect ? redirectPath : fallbackTo\n}\n"],"names":["getSafeRedirect","allowAbsoluteUrls","fallbackTo","redirectTo","redirectPath","trim","hasControlCharacters","some","character","code","charCodeAt","hasAmbiguousPathPrefix","test","parsedRedirect","URL","isSafeRedirect","startsWith","origin","toLowerCase","isAbsoluteSafeRedirect","protocol"],"mappings":"AAAA,OAAO,MAAMA,kBAAkB,CAAC,EAC9BC,oBAAoB,KAAK,EACzBC,aAAa,GAAG,EAChBC,UAAU,EAKX;IACC,IAAI,OAAOA,eAAe,UAAU;QAClC,OAAOD;IACT;IAEA,MAAME,eAAeD,WAAWE,IAAI;IAEpC,MAAMC,uBAAuB;WAAIF;KAAa,CAACG,IAAI,CAAC,CAACC;QACnD,MAAMC,OAAOD,UAAUE,UAAU,CAAC;QAClC,OAAOD,QAAQ,MAAMA,SAAS;IAChC;IACA,MAAME,yBAAyB,iCAAiCC,IAAI,CAACR;IAErE,IAAIS;IACJ,IAAI;QACFA,iBAAiB,IAAIC,IAAIV,cAAc;IACzC,EAAE,OAAM;QACN,OAAOF;IACT;IAEA,MAAMa,iBACJ,CAACT,wBACD,CAACK,0BACD,0DAA0D;IAC1DP,aAAaY,UAAU,CAAC,QACxB,iEAAiE;IACjEH,eAAeI,MAAM,KAAK,sBAC1B,yDAAyD;IACzD,CAACb,aAAaY,UAAU,CAAC,SACzB,kEAAkE;IAClE,CAACZ,aAAaY,UAAU,CAAC,WACzB,0GAA0G;IAC1G,CAACZ,aAAaY,UAAU,CAAC,WACzB,CAACZ,aAAaY,UAAU,CAAC,YACzB,CAACZ,aAAaY,UAAU,CAAC,UACzB,kEAAkE;IAClE,CAACZ,aAAac,WAAW,GAAGF,UAAU,CAAC,mBACvC,wEAAwE;IACxE,CAACZ,aAAac,WAAW,GAAGF,UAAU,CAAC;IAEzC,MAAMG,yBACJlB,qBACA,CAACK,wBACD,kDAAkD;IAClD,oBAAoBM,IAAI,CAACR,iBACxBS,CAAAA,eAAeO,QAAQ,KAAK,WAAWP,eAAeO,QAAQ,KAAK,QAAO;IAE7E,OAAOL,kBAAkBI,yBAAyBf,eAAeF;AACnE,EAAC"}

package/dist/utilities/getSafeRedirect.spec.js

@@ -39,6 +39,30 @@ describe('getSafeRedirect', ()=>{
             fallbackTo: fallback
         })).toBe(fallback);
     });
+    it.each([
+        'redirect=%2F%09%2Fexample.invalid',
+        'redirect=%2F%0D%2Fexample.invalid',
+        'redirect=%2F%0A%2Fexample.invalid'
+    ])('should use the fallback when a path resolves outside the current origin: %s', (query)=>{
+        const redirectTo = new URLSearchParams(query).get('redirect');
+        expect(redirectTo).not.toBeNull();
+        expect(getSafeRedirect({
+            redirectTo: redirectTo,
+            fallbackTo: fallback
+        })).toBe(fallback);
+    });
+    it.each([
+        '/%2509/example.invalid',
+        '/%250D/example.invalid',
+        '/%250A/example.invalid',
+        '/%255Cexample.invalid',
+        '/%252fexample.invalid'
+    ])('should use the fallback for ambiguous encoded path prefixes: %s', (input)=>{
+        expect(getSafeRedirect({
+            redirectTo: input,
+            fallbackTo: fallback
+        })).toBe(fallback);
+    });
     // Unsafe redirect patterns
     it.each([
         '//example.com',
@@ -72,13 +96,63 @@ describe('getSafeRedirect', ()=>{
             fallbackTo: fallback
         })).toBe(fallback);
     });
-    // If decoding the input fails (e.g., invalid percent encoding), it should not crash
-    it('should return fallback on invalid encoding', ()=>{
+    it('should return fallback when the input is not a path or URL', ()=>{
         expect(getSafeRedirect({
             redirectTo: '%E0%A4%A',
             fallbackTo: fallback
         })).toBe(fallback);
     });
+    it('should preserve an accepted local redirect', ()=>{
+        const redirectTo = '/dashboard?tab=overview#details';
+        expect(getSafeRedirect({
+            redirectTo,
+            fallbackTo: fallback
+        })).toBe(redirectTo);
+    });
+    it('should preserve a parsed navigation target byte-for-byte', ()=>{
+        const redirectTo = new URLSearchParams('redirect=%2Foauth%2Fcallback%3Fcode%3DA%252FB%26state%3Dopaque%253D%23done').get('redirect');
+        expect(redirectTo).toBe('/oauth/callback?code=A%2FB&state=opaque%3D#done');
+        expect(getSafeRedirect({
+            redirectTo: redirectTo,
+            fallbackTo: fallback
+        })).toBe('/oauth/callback?code=A%2FB&state=opaque%3D#done');
+    });
+    it.each([
+        [
+            'https://example.invalid/path?code=A%252FB#done',
+            'https://example.invalid/path?code=A%252FB#done'
+        ],
+        [
+            'http://example.invalid/dashboard',
+            'http://example.invalid/dashboard'
+        ]
+    ])('should preserve an HTTP absolute redirect when enabled: %s', (input, expected)=>{
+        expect(getSafeRedirect({
+            allowAbsoluteUrls: true,
+            redirectTo: input,
+            fallbackTo: fallback
+        })).toBe(expected);
+    });
+    it.each([
+        [
+            'https://example.invalid/path',
+            false
+        ],
+        [
+            'mailto:user@example.invalid',
+            true
+        ],
+        [
+            '//example.invalid/path',
+            true
+        ]
+    ])('should use the fallback without an explicitly enabled HTTP(S) URL: %s', (input, allowAbsoluteUrls)=>{
+        expect(getSafeRedirect({
+            allowAbsoluteUrls,
+            redirectTo: input,
+            fallbackTo: fallback
+        })).toBe(fallback);
+    });
 });
 
 //# sourceMappingURL=getSafeRedirect.spec.js.map

package/dist/utilities/getSafeRedirect.spec.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/getSafeRedirect.spec.ts"],"sourcesContent":["import { describe, it, expect } from 'vitest'\nimport { getSafeRedirect } from './getSafeRedirect'\n\nconst fallback = '/admin' // default fallback if the input is unsafe or invalid\n\ndescribe('getSafeRedirect', () => {\n  // Valid - safe redirect paths\n  it.each([['/dashboard'], ['/admin/settings'], ['/projects?id=123'], ['/hello-world']])(\n    'should allow safe relative path: %s',\n    (input) => {\n      // If the input is a clean relative path, it should be returned as-is\n      expect(getSafeRedirect({ redirectTo: input, fallbackTo: fallback })).toBe(input)\n    },\n  )\n\n  // Invalid types or empty inputs\n  it.each(['', null, undefined, 123, {}, []])(\n    'should fallback on invalid or non-string input: %s',\n    (input) => {\n      // If the input is not a valid string, it should return the fallback\n      expect(getSafeRedirect({ redirectTo: input as any, fallbackTo: fallback })).toBe(fallback)\n    },\n  )\n\n  // Unsafe redirect patterns\n  it.each([\n    '//example.com', // protocol-relative URL\n    '/javascript:alert(1)', // JavaScript scheme\n    '/JavaScript:alert(1)', // case-insensitive JavaScript\n    '/http://unknown.com', // disguised external redirect\n    '/https://unknown.com', // disguised external redirect\n    '/%2Funknown.com', // encoded slash — could resolve to //\n    '/\\\\/unknown.com', // escaped slash\n    '/\\\\\\\\unknown.com', // double escaped slashes\n    '/\\\\unknown.com', // single escaped slash\n    '%2F%2Funknown.com', // fully encoded protocol-relative path\n    '%2Fjavascript:alert(1)', // encoded JavaScript scheme\n  ])('should block unsafe redirect: %s', (input) => {\n    // All of these should return the fallback because they’re unsafe\n    expect(getSafeRedirect({ redirectTo: input, fallbackTo: fallback })).toBe(fallback)\n  })\n\n  // Input with extra spaces should still be properly handled\n  it('should trim whitespace before evaluating', () => {\n    // A valid path with surrounding spaces should still be accepted\n    expect(getSafeRedirect({ redirectTo: '   /dashboard   ', fallbackTo: fallback })).toBe(\n      '/dashboard',\n    )\n\n    // An unsafe path with spaces should still be rejected\n    expect(getSafeRedirect({ redirectTo: '   //example.com   ', fallbackTo: fallback })).toBe(\n      fallback,\n    )\n  })\n\n  // If decoding the input fails (e.g., invalid percent encoding), it should not crash\n  it('should return fallback on invalid encoding', () => {\n    expect(getSafeRedirect({ redirectTo: '%E0%A4%A', fallbackTo: fallback })).toBe(fallback)\n  })\n})\n"],"names":["describe","it","expect","getSafeRedirect","fallback","each","input","redirectTo","fallbackTo","toBe","undefined"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,EAAE,EAAEC,MAAM,QAAQ,SAAQ;AAC7C,SAASC,eAAe,QAAQ,oBAAmB;AAEnD,MAAMC,WAAW,SAAS,qDAAqD;;AAE/EJ,SAAS,mBAAmB;IAC1B,8BAA8B;IAC9BC,GAAGI,IAAI,CAAC;QAAC;YAAC;SAAa;QAAE;YAAC;SAAkB;QAAE;YAAC;SAAmB;QAAE;YAAC;SAAe;KAAC,EACnF,uCACA,CAACC;QACC,qEAAqE;QACrEJ,OAAOC,gBAAgB;YAAEI,YAAYD;YAAOE,YAAYJ;QAAS,IAAIK,IAAI,CAACH;IAC5E;IAGF,gCAAgC;IAChCL,GAAGI,IAAI,CAAC;QAAC;QAAI;QAAMK;QAAW;QAAK,CAAC;QAAG,EAAE;KAAC,EACxC,sDACA,CAACJ;QACC,oEAAoE;QACpEJ,OAAOC,gBAAgB;YAAEI,YAAYD;YAAcE,YAAYJ;QAAS,IAAIK,IAAI,CAACL;IACnF;IAGF,2BAA2B;IAC3BH,GAAGI,IAAI,CAAC;QACN;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;KACD,EAAE,oCAAoC,CAACC;QACtC,iEAAiE;QACjEJ,OAAOC,gBAAgB;YAAEI,YAAYD;YAAOE,YAAYJ;QAAS,IAAIK,IAAI,CAACL;IAC5E;IAEA,2DAA2D;IAC3DH,GAAG,4CAA4C;QAC7C,gEAAgE;QAChEC,OAAOC,gBAAgB;YAAEI,YAAY;YAAoBC,YAAYJ;QAAS,IAAIK,IAAI,CACpF;QAGF,sDAAsD;QACtDP,OAAOC,gBAAgB;YAAEI,YAAY;YAAuBC,YAAYJ;QAAS,IAAIK,IAAI,CACvFL;IAEJ;IAEA,oFAAoF;IACpFH,GAAG,8CAA8C;QAC/CC,OAAOC,gBAAgB;YAAEI,YAAY;YAAYC,YAAYJ;QAAS,IAAIK,IAAI,CAACL;IACjF;AACF"}
+{"version":3,"sources":["../../src/utilities/getSafeRedirect.spec.ts"],"sourcesContent":["import { describe, it, expect } from 'vitest'\nimport { getSafeRedirect } from './getSafeRedirect'\n\nconst fallback = '/admin' // default fallback if the input is unsafe or invalid\n\ndescribe('getSafeRedirect', () => {\n  // Valid - safe redirect paths\n  it.each([['/dashboard'], ['/admin/settings'], ['/projects?id=123'], ['/hello-world']])(\n    'should allow safe relative path: %s',\n    (input) => {\n      // If the input is a clean relative path, it should be returned as-is\n      expect(getSafeRedirect({ redirectTo: input, fallbackTo: fallback })).toBe(input)\n    },\n  )\n\n  // Invalid types or empty inputs\n  it.each(['', null, undefined, 123, {}, []])(\n    'should fallback on invalid or non-string input: %s',\n    (input) => {\n      // If the input is not a valid string, it should return the fallback\n      expect(getSafeRedirect({ redirectTo: input as any, fallbackTo: fallback })).toBe(fallback)\n    },\n  )\n\n  it.each([\n    'redirect=%2F%09%2Fexample.invalid',\n    'redirect=%2F%0D%2Fexample.invalid',\n    'redirect=%2F%0A%2Fexample.invalid',\n  ])('should use the fallback when a path resolves outside the current origin: %s', (query) => {\n    const redirectTo = new URLSearchParams(query).get('redirect')\n\n    expect(redirectTo).not.toBeNull()\n    expect(getSafeRedirect({ redirectTo: redirectTo!, fallbackTo: fallback })).toBe(fallback)\n  })\n\n  it.each([\n    '/%2509/example.invalid',\n    '/%250D/example.invalid',\n    '/%250A/example.invalid',\n    '/%255Cexample.invalid',\n    '/%252fexample.invalid',\n  ])('should use the fallback for ambiguous encoded path prefixes: %s', (input) => {\n    expect(getSafeRedirect({ redirectTo: input, fallbackTo: fallback })).toBe(fallback)\n  })\n\n  // Unsafe redirect patterns\n  it.each([\n    '//example.com', // protocol-relative URL\n    '/javascript:alert(1)', // JavaScript scheme\n    '/JavaScript:alert(1)', // case-insensitive JavaScript\n    '/http://unknown.com', // disguised external redirect\n    '/https://unknown.com', // disguised external redirect\n    '/%2Funknown.com', // encoded slash — could resolve to //\n    '/\\\\/unknown.com', // escaped slash\n    '/\\\\\\\\unknown.com', // double escaped slashes\n    '/\\\\unknown.com', // single escaped slash\n    '%2F%2Funknown.com', // fully encoded protocol-relative path\n    '%2Fjavascript:alert(1)', // encoded JavaScript scheme\n  ])('should block unsafe redirect: %s', (input) => {\n    // All of these should return the fallback because they’re unsafe\n    expect(getSafeRedirect({ redirectTo: input, fallbackTo: fallback })).toBe(fallback)\n  })\n\n  // Input with extra spaces should still be properly handled\n  it('should trim whitespace before evaluating', () => {\n    // A valid path with surrounding spaces should still be accepted\n    expect(getSafeRedirect({ redirectTo: '   /dashboard   ', fallbackTo: fallback })).toBe(\n      '/dashboard',\n    )\n\n    // An unsafe path with spaces should still be rejected\n    expect(getSafeRedirect({ redirectTo: '   //example.com   ', fallbackTo: fallback })).toBe(\n      fallback,\n    )\n  })\n\n  it('should return fallback when the input is not a path or URL', () => {\n    expect(getSafeRedirect({ redirectTo: '%E0%A4%A', fallbackTo: fallback })).toBe(fallback)\n  })\n\n  it('should preserve an accepted local redirect', () => {\n    const redirectTo = '/dashboard?tab=overview#details'\n\n    expect(getSafeRedirect({ redirectTo, fallbackTo: fallback })).toBe(redirectTo)\n  })\n\n  it('should preserve a parsed navigation target byte-for-byte', () => {\n    const redirectTo = new URLSearchParams(\n      'redirect=%2Foauth%2Fcallback%3Fcode%3DA%252FB%26state%3Dopaque%253D%23done',\n    ).get('redirect')\n\n    expect(redirectTo).toBe('/oauth/callback?code=A%2FB&state=opaque%3D#done')\n    expect(getSafeRedirect({ redirectTo: redirectTo!, fallbackTo: fallback })).toBe(\n      '/oauth/callback?code=A%2FB&state=opaque%3D#done',\n    )\n  })\n\n  it.each([\n    [\n      'https://example.invalid/path?code=A%252FB#done',\n      'https://example.invalid/path?code=A%252FB#done',\n    ],\n    ['http://example.invalid/dashboard', 'http://example.invalid/dashboard'],\n  ])('should preserve an HTTP absolute redirect when enabled: %s', (input, expected) => {\n    expect(\n      getSafeRedirect({\n        allowAbsoluteUrls: true,\n        redirectTo: input,\n        fallbackTo: fallback,\n      }),\n    ).toBe(expected)\n  })\n\n  it.each([\n    ['https://example.invalid/path', false],\n    ['mailto:user@example.invalid', true],\n    ['//example.invalid/path', true],\n  ])(\n    'should use the fallback without an explicitly enabled HTTP(S) URL: %s',\n    (input, allowAbsoluteUrls) => {\n      expect(getSafeRedirect({ allowAbsoluteUrls, redirectTo: input, fallbackTo: fallback })).toBe(\n        fallback,\n      )\n    },\n  )\n})\n"],"names":["describe","it","expect","getSafeRedirect","fallback","each","input","redirectTo","fallbackTo","toBe","undefined","query","URLSearchParams","get","not","toBeNull","expected","allowAbsoluteUrls"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,EAAE,EAAEC,MAAM,QAAQ,SAAQ;AAC7C,SAASC,eAAe,QAAQ,oBAAmB;AAEnD,MAAMC,WAAW,SAAS,qDAAqD;;AAE/EJ,SAAS,mBAAmB;IAC1B,8BAA8B;IAC9BC,GAAGI,IAAI,CAAC;QAAC;YAAC;SAAa;QAAE;YAAC;SAAkB;QAAE;YAAC;SAAmB;QAAE;YAAC;SAAe;KAAC,EACnF,uCACA,CAACC;QACC,qEAAqE;QACrEJ,OAAOC,gBAAgB;YAAEI,YAAYD;YAAOE,YAAYJ;QAAS,IAAIK,IAAI,CAACH;IAC5E;IAGF,gCAAgC;IAChCL,GAAGI,IAAI,CAAC;QAAC;QAAI;QAAMK;QAAW;QAAK,CAAC;QAAG,EAAE;KAAC,EACxC,sDACA,CAACJ;QACC,oEAAoE;QACpEJ,OAAOC,gBAAgB;YAAEI,YAAYD;YAAcE,YAAYJ;QAAS,IAAIK,IAAI,CAACL;IACnF;IAGFH,GAAGI,IAAI,CAAC;QACN;QACA;QACA;KACD,EAAE,+EAA+E,CAACM;QACjF,MAAMJ,aAAa,IAAIK,gBAAgBD,OAAOE,GAAG,CAAC;QAElDX,OAAOK,YAAYO,GAAG,CAACC,QAAQ;QAC/Bb,OAAOC,gBAAgB;YAAEI,YAAYA;YAAaC,YAAYJ;QAAS,IAAIK,IAAI,CAACL;IAClF;IAEAH,GAAGI,IAAI,CAAC;QACN;QACA;QACA;QACA;QACA;KACD,EAAE,mEAAmE,CAACC;QACrEJ,OAAOC,gBAAgB;YAAEI,YAAYD;YAAOE,YAAYJ;QAAS,IAAIK,IAAI,CAACL;IAC5E;IAEA,2BAA2B;IAC3BH,GAAGI,IAAI,CAAC;QACN;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;KACD,EAAE,oCAAoC,CAACC;QACtC,iEAAiE;QACjEJ,OAAOC,gBAAgB;YAAEI,YAAYD;YAAOE,YAAYJ;QAAS,IAAIK,IAAI,CAACL;IAC5E;IAEA,2DAA2D;IAC3DH,GAAG,4CAA4C;QAC7C,gEAAgE;QAChEC,OAAOC,gBAAgB;YAAEI,YAAY;YAAoBC,YAAYJ;QAAS,IAAIK,IAAI,CACpF;QAGF,sDAAsD;QACtDP,OAAOC,gBAAgB;YAAEI,YAAY;YAAuBC,YAAYJ;QAAS,IAAIK,IAAI,CACvFL;IAEJ;IAEAH,GAAG,8DAA8D;QAC/DC,OAAOC,gBAAgB;YAAEI,YAAY;YAAYC,YAAYJ;QAAS,IAAIK,IAAI,CAACL;IACjF;IAEAH,GAAG,8CAA8C;QAC/C,MAAMM,aAAa;QAEnBL,OAAOC,gBAAgB;YAAEI;YAAYC,YAAYJ;QAAS,IAAIK,IAAI,CAACF;IACrE;IAEAN,GAAG,4DAA4D;QAC7D,MAAMM,aAAa,IAAIK,gBACrB,8EACAC,GAAG,CAAC;QAENX,OAAOK,YAAYE,IAAI,CAAC;QACxBP,OAAOC,gBAAgB;YAAEI,YAAYA;YAAaC,YAAYJ;QAAS,IAAIK,IAAI,CAC7E;IAEJ;IAEAR,GAAGI,IAAI,CAAC;QACN;YACE;YACA;SACD;QACD;YAAC;YAAoC;SAAmC;KACzE,EAAE,8DAA8D,CAACC,OAAOU;QACvEd,OACEC,gBAAgB;YACdc,mBAAmB;YACnBV,YAAYD;YACZE,YAAYJ;QACd,IACAK,IAAI,CAACO;IACT;IAEAf,GAAGI,IAAI,CAAC;QACN;YAAC;YAAgC;SAAM;QACvC;YAAC;YAA+B;SAAK;QACrC;YAAC;YAA0B;SAAK;KACjC,EACC,yEACA,CAACC,OAAOW;QACNf,OAAOC,gBAAgB;YAAEc;YAAmBV,YAAYD;YAAOE,YAAYJ;QAAS,IAAIK,IAAI,CAC1FL;IAEJ;AAEJ"}

package/dist/versions/drafts/appendVersionToQueryKey.js

@@ -1,11 +1,9 @@
 export const appendVersionToQueryKey = (query = {})=>{
     return Object.entries(query).reduce((res, [key, val])=>{
         if ([
-            'AND',
             'and',
-            'OR',
             'or'
-        ].includes(key) && Array.isArray(val)) {
+        ].includes(key.toLowerCase()) && Array.isArray(val)) {
             return {
                 ...res,
                 [key.toLowerCase()]: val.map((subQuery)=>appendVersionToQueryKey(subQuery))

package/dist/versions/drafts/appendVersionToQueryKey.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/versions/drafts/appendVersionToQueryKey.ts"],"sourcesContent":["import type { Where } from '../../types/index.js'\n\nexport const appendVersionToQueryKey = (query: Where = {}): Where => {\n  return Object.entries(query).reduce((res, [key, val]) => {\n    if (['AND', 'and', 'OR', 'or'].includes(key) && Array.isArray(val)) {\n      return {\n        ...res,\n        [key.toLowerCase()]: val.map((subQuery) => appendVersionToQueryKey(subQuery)),\n      }\n    }\n\n    if (key !== 'id') {\n      return {\n        ...res,\n        [`version.${key}`]: val,\n      }\n    }\n\n    return {\n      ...res,\n      parent: val,\n    }\n  }, {})\n}\n"],"names":["appendVersionToQueryKey","query","Object","entries","reduce","res","key","val","includes","Array","isArray","toLowerCase","map","subQuery","parent"],"mappings":"AAEA,OAAO,MAAMA,0BAA0B,CAACC,QAAe,CAAC,CAAC;IACvD,OAAOC,OAAOC,OAAO,CAACF,OAAOG,MAAM,CAAC,CAACC,KAAK,CAACC,KAAKC,IAAI;QAClD,IAAI;YAAC;YAAO;YAAO;YAAM;SAAK,CAACC,QAAQ,CAACF,QAAQG,MAAMC,OAAO,CAACH,MAAM;YAClE,OAAO;gBACL,GAAGF,GAAG;gBACN,CAACC,IAAIK,WAAW,GAAG,EAAEJ,IAAIK,GAAG,CAAC,CAACC,WAAab,wBAAwBa;YACrE;QACF;QAEA,IAAIP,QAAQ,MAAM;YAChB,OAAO;gBACL,GAAGD,GAAG;gBACN,CAAC,CAAC,QAAQ,EAAEC,KAAK,CAAC,EAAEC;YACtB;QACF;QAEA,OAAO;YACL,GAAGF,GAAG;YACNS,QAAQP;QACV;IACF,GAAG,CAAC;AACN,EAAC"}
+{"version":3,"sources":["../../../src/versions/drafts/appendVersionToQueryKey.ts"],"sourcesContent":["import type { Where } from '../../types/index.js'\n\nexport const appendVersionToQueryKey = (query: Where = {}): Where => {\n  return Object.entries(query).reduce((res, [key, val]) => {\n    if (['and', 'or'].includes(key.toLowerCase()) && Array.isArray(val)) {\n      return {\n        ...res,\n        [key.toLowerCase()]: val.map((subQuery) => appendVersionToQueryKey(subQuery)),\n      }\n    }\n\n    if (key !== 'id') {\n      return {\n        ...res,\n        [`version.${key}`]: val,\n      }\n    }\n\n    return {\n      ...res,\n      parent: val,\n    }\n  }, {})\n}\n"],"names":["appendVersionToQueryKey","query","Object","entries","reduce","res","key","val","includes","toLowerCase","Array","isArray","map","subQuery","parent"],"mappings":"AAEA,OAAO,MAAMA,0BAA0B,CAACC,QAAe,CAAC,CAAC;IACvD,OAAOC,OAAOC,OAAO,CAACF,OAAOG,MAAM,CAAC,CAACC,KAAK,CAACC,KAAKC,IAAI;QAClD,IAAI;YAAC;YAAO;SAAK,CAACC,QAAQ,CAACF,IAAIG,WAAW,OAAOC,MAAMC,OAAO,CAACJ,MAAM;YACnE,OAAO;gBACL,GAAGF,GAAG;gBACN,CAACC,IAAIG,WAAW,GAAG,EAAEF,IAAIK,GAAG,CAAC,CAACC,WAAab,wBAAwBa;YACrE;QACF;QAEA,IAAIP,QAAQ,MAAM;YAChB,OAAO;gBACL,GAAGD,GAAG;gBACN,CAAC,CAAC,QAAQ,EAAEC,KAAK,CAAC,EAAEC;YACtB;QACF;QAEA,OAAO;YACL,GAAGF,GAAG;YACNS,QAAQP;QACV;IACF,GAAG,CAAC;AACN,EAAC"}

package/dist/versions/drafts/appendVersionToQueryKey.spec.js

@@ -0,0 +1,28 @@
+import { describe, expect, it } from 'vitest';
+import { appendVersionToQueryKey } from './appendVersionToQueryKey.js';
+describe('appendVersionToQueryKey', ()=>{
+    it.each([
+        'aNd',
+        'oR'
+    ])('should preserve case-insensitive %s conditions when prefixing version fields', (logicalOperator)=>{
+        expect(appendVersionToQueryKey({
+            [logicalOperator]: [
+                {
+                    title: {
+                        equals: 'example'
+                    }
+                }
+            ]
+        })).toStrictEqual({
+            [logicalOperator.toLowerCase()]: [
+                {
+                    'version.title': {
+                        equals: 'example'
+                    }
+                }
+            ]
+        });
+    });
+});
+
+//# sourceMappingURL=appendVersionToQueryKey.spec.js.map

package/dist/versions/drafts/appendVersionToQueryKey.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/versions/drafts/appendVersionToQueryKey.spec.ts"],"sourcesContent":["import { describe, expect, it } from 'vitest'\n\nimport { appendVersionToQueryKey } from './appendVersionToQueryKey.js'\n\ndescribe('appendVersionToQueryKey', () => {\n  it.each(['aNd', 'oR'])(\n    'should preserve case-insensitive %s conditions when prefixing version fields',\n    (logicalOperator) => {\n      expect(\n        appendVersionToQueryKey({\n          [logicalOperator]: [\n            {\n              title: {\n                equals: 'example',\n              },\n            },\n          ],\n        }),\n      ).toStrictEqual({\n        [logicalOperator.toLowerCase()]: [\n          {\n            'version.title': {\n              equals: 'example',\n            },\n          },\n        ],\n      })\n    },\n  )\n})\n"],"names":["describe","expect","it","appendVersionToQueryKey","each","logicalOperator","title","equals","toStrictEqual","toLowerCase"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAE7C,SAASC,uBAAuB,QAAQ,+BAA8B;AAEtEH,SAAS,2BAA2B;IAClCE,GAAGE,IAAI,CAAC;QAAC;QAAO;KAAK,EACnB,gFACA,CAACC;QACCJ,OACEE,wBAAwB;YACtB,CAACE,gBAAgB,EAAE;gBACjB;oBACEC,OAAO;wBACLC,QAAQ;oBACV;gBACF;aACD;QACH,IACAC,aAAa,CAAC;YACd,CAACH,gBAAgBI,WAAW,GAAG,EAAE;gBAC/B;oBACE,iBAAiB;wBACfF,QAAQ;oBACV;gBACF;aACD;QACH;IACF;AAEJ"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "payload",
-  "version": "3.87.1",
+  "version": "3.88.0",
   "description": "Node, React, Headless CMS and Application Framework built on Next.js",
   "keywords": [
     "admin panel",
@@ -115,7 +115,7 @@
     "undici": "7.29.0",
     "uuid": "13.0.2",
     "ws": "^8.16.0",
-    "@payloadcms/translations": "3.87.1"
+    "@payloadcms/translations": "3.88.0"
   },
   "devDependencies": {
     "@hyrious/esbuild-plugin-commonjs": "0.2.6",