react-router 8.3.0 → 8.3.1

package/dist/production/index-react-server.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -24,7 +24,7 @@ function warning(cond, message) {
 		if (typeof console !== "undefined") console.warn(message);
 		try {
 			throw new Error(message);
-		} catch (e) {}
+		} catch {}
 	}
 }
 function createKey$1() {
@@ -506,13 +506,13 @@ function matchPathImpl(pattern, pathname, matcher, compiledParams) {
 	let match = pathname.match(matcher);
 	if (!match) return null;
 	let matchedPathname = match[0];
-	let pathnameBase = matchedPathname.replace(/(.)\/+$/, "$1");
+	let pathnameBase = removeTrailingSlash(matchedPathname, 1);
 	let captureGroups = match.slice(1);
 	return {
 		params: compiledParams.reduce((memo, { paramName, isOptional }, index) => {
 			if (paramName === "*") {
 				let splatValue = captureGroups[index] || "";
-				pathnameBase = matchedPathname.slice(0, matchedPathname.length - splatValue.length).replace(/(.)\/+$/, "$1");
+				pathnameBase = removeTrailingSlash(matchedPathname.slice(0, matchedPathname.length - splatValue.length), 1);
 			}
 			const value = captureGroups[index];
 			if (isOptional && !value) memo[paramName] = void 0;
@@ -581,7 +581,7 @@ function resolvePath(to, fromPathname = "/") {
 	let pathname;
 	if (toPathname) {
 		toPathname = removeDoubleSlashes(toPathname);
-		if (toPathname.startsWith("/")) pathname = resolvePathname(toPathname.substring(1), "/");
+		if (toPathname.startsWith("/") || toPathname.startsWith("\\")) pathname = resolvePathname(toPathname.substring(1), "/");
 		else pathname = resolvePathname(toPathname, fromPathname);
 	} else pathname = fromPathname;
 	return {
@@ -642,7 +642,11 @@ function resolveTo(toArg, routePathnames, locationPathname, isPathRelative = fal
 }
 const removeDoubleSlashes = (path) => path.replace(/[\\/]{2,}/g, "/");
 const joinPaths = (paths) => removeDoubleSlashes(paths.join("/"));
-const removeTrailingSlash = (path) => path.replace(/\/+$/, "");
+function removeTrailingSlash(path, minLength = 0) {
+	let end = path.length;
+	while (end > minLength && path.charCodeAt(end - 1) === 47) end--;
+	return end === path.length ? path : path.slice(0, end);
+}
 const normalizePathname = (pathname) => removeTrailingSlash(pathname).replace(/^\/*/, "/");
 const normalizeSearch = (search) => !search || search === "?" ? "" : search.startsWith("?") ? search : "?" + search;
 const normalizeHash = (hash) => !hash || hash === "#" ? "" : hash.startsWith("#") ? hash : "#" + hash;
@@ -1807,7 +1811,7 @@ async function callDataStrategyImpl(dataStrategyImpl, request, path, matches, fe
 	});
 	try {
 		await Promise.all(matches.flatMap((m) => [m._lazyPromises?.handler, m._lazyPromises?.route]));
-	} catch (e) {}
+	} catch {}
 	return results;
 }
 async function callLoaderOrAction({ request, path, pattern, match, lazyHandlerPromise, lazyRoutePromise, handlerOverride, scopedContext }) {
@@ -2208,14 +2212,19 @@ function getPathsWithAncestors(paths) {
 function throwIfPotentialCSRFAttack(request, allowedActionOrigins) {
 	let originHeader = request.headers.get("origin");
 	let originDomain = null;
+	let originUrl = null;
 	try {
-		originDomain = typeof originHeader === "string" && originHeader !== "null" ? new URL(originHeader).host : originHeader;
+		if (typeof originHeader === "string" && originHeader !== "null") {
+			originUrl = new URL(originHeader);
+			originDomain = originUrl.host;
+		} else originDomain = originHeader;
 	} catch {
 		throw new Error(`\`origin\` header is not a valid URL. Aborting the action.`);
 	}
-	let host = new URL(request.url).host;
-	if (originDomain && originDomain !== host) {
-		if (!isAllowedOrigin(originDomain, allowedActionOrigins)) throw new Error("The `request.url` host does not match `origin` header from a forwarded action request. Aborting the action.");
+	let requestUrl = new URL(request.url);
+	let originMatchesRequest = originUrl ? originUrl.origin === requestUrl.origin : originDomain === requestUrl.host;
+	if (originDomain && !originMatchesRequest) {
+		if (!isAllowedOrigin(originDomain, allowedActionOrigins)) throw new Error("The `request.url` origin does not match `origin` header from a forwarded action request. Aborting the action.");
 	}
 }
 function matchWildcardDomain(domain, pattern) {
@@ -2939,7 +2948,7 @@ const unsign = async (cookie, secret) => {
 	try {
 		let signature = byteStringToUint8Array(atob(hash));
 		return await crypto.subtle.verify("HMAC", key, signature, data) ? value : false;
-	} catch (e) {
+	} catch {
 		return false;
 	}
 };
@@ -3037,7 +3046,7 @@ function encodeData(value) {
 function decodeData(value) {
 	try {
 		return JSON.parse(decodeURIComponent(myEscape(atob(value))));
-	} catch (e) {
+	} catch {
 		return {};
 	}
 }

package/dist/production/index.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/actions.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -12,14 +12,19 @@
 function throwIfPotentialCSRFAttack(request, allowedActionOrigins) {
 	let originHeader = request.headers.get("origin");
 	let originDomain = null;
+	let originUrl = null;
 	try {
-		originDomain = typeof originHeader === "string" && originHeader !== "null" ? new URL(originHeader).host : originHeader;
+		if (typeof originHeader === "string" && originHeader !== "null") {
+			originUrl = new URL(originHeader);
+			originDomain = originUrl.host;
+		} else originDomain = originHeader;
 	} catch {
 		throw new Error(`\`origin\` header is not a valid URL. Aborting the action.`);
 	}
-	let host = new URL(request.url).host;
-	if (originDomain && originDomain !== host) {
-		if (!isAllowedOrigin(originDomain, allowedActionOrigins)) throw new Error("The `request.url` host does not match `origin` header from a forwarded action request. Aborting the action.");
+	let requestUrl = new URL(request.url);
+	let originMatchesRequest = originUrl ? originUrl.origin === requestUrl.origin : originDomain === requestUrl.host;
+	if (originDomain && !originMatchesRequest) {
+		if (!isAllowedOrigin(originDomain, allowedActionOrigins)) throw new Error("The `request.url` origin does not match `origin` header from a forwarded action request. Aborting the action.");
 	}
 }
 function matchWildcardDomain(domain, pattern) {

package/dist/production/lib/components.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -8,8 +8,9 @@
  *
  * @license MIT
  */
-import { createMemoryHistory, invariant, parsePath, warning } from "./router/history.js";
+import { createMemoryHistory, createPath, invariant, parsePath, warning } from "./router/history.js";
 import { defaultMapRouteProperties, getResolveToMatches, getRoutePattern, resolveTo, stripBasename } from "./router/utils.js";
+import { getNavigatorCurrentUrl, validateNavigationTarget } from "./router/navigation.js";
 import { createRouter } from "./router/router.js";
 import { AwaitContext, DataRouterContext, DataRouterStateContext, FetchersContext, LocationContext, NavigationContext, RouteContext, ViewTransitionContext, useIsRSCRouterContext } from "./context.js";
 import { _renderMatches, useActionData, useAsyncValue, useInRouterContext, useLoaderData, useLocation, useMatches, useNavigate, useOutlet, useParams, useRouteError, useRoutes, useRoutesImpl } from "./hooks.js";
@@ -256,6 +257,7 @@ function RouterProvider({ router, flushSync: reactDomFlushSyncImpl, onError, use
 	let navigator = React$1.useMemo(() => {
 		return {
 			createHref: router.createHref,
+			createURL: router.createURL,
 			encodeLocation: router.encodeLocation,
 			go: (n) => router.navigate(n),
 			push: (to, state, opts) => router.navigate(to, {
@@ -379,12 +381,13 @@ function MemoryRouter({ basename, children, initialEntries, initialIndex, useTra
 */
 function Navigate({ to, replace, state, relative }) {
 	invariant(useInRouterContext(), `<Navigate> may be used only in the context of a <Router> component.`);
-	let { static: isStatic } = React$1.useContext(NavigationContext);
+	let { static: isStatic, navigator } = React$1.useContext(NavigationContext);
 	warning(!isStatic, "<Navigate> must not be used on the initial render in a <StaticRouter>. This is a no-op, but you should modify your code so the <Navigate> is only ever rendered in response to some user interaction or state change.");
 	let { matches } = React$1.useContext(RouteContext);
 	let { pathname: locationPathname } = useLocation();
 	let navigate = useNavigate();
 	let path = resolveTo(to, getResolveToMatches(matches), locationPathname, relative === "path");
+	validateNavigationTarget(typeof to === "string" ? to : createPath(to), navigator.createHref(path), getNavigatorCurrentUrl(navigator), "reject");
 	let jsonPath = JSON.stringify(path);
 	React$1.useEffect(() => {
 		navigate(JSON.parse(jsonPath), {

package/dist/production/lib/context.d.ts

@@ -55,6 +55,7 @@ interface NavigateOptions {
  */
 interface Navigator {
   createHref: History["createHref"];
+  createURL?: History["createURL"];
   encodeLocation?: History["encodeLocation"];
   go: History["go"];
   push(to: To, state?: any, opts?: NavigateOptions): void;

package/dist/production/lib/context.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/dom/dom.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -75,7 +75,7 @@ function isFormDataSubmitterSupported() {
 	if (_formDataSupportsSubmitter === null) try {
 		new FormData(document.createElement("form"), 0);
 		_formDataSupportsSubmitter = false;
-	} catch (e) {
+	} catch {
 		_formDataSupportsSubmitter = true;
 	}
 	return _formDataSupportsSubmitter;

package/dist/production/lib/dom/lib.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -22,8 +22,8 @@ import * as React$1 from "react";
 //#region lib/dom/lib.tsx
 const isBrowser = typeof window !== "undefined" && typeof window.document !== "undefined" && typeof window.document.createElement !== "undefined";
 try {
-	if (isBrowser) window.__reactRouterVersion = "8.3.0";
-} catch (e) {}
+	if (isBrowser) window.__reactRouterVersion = "8";
+} catch {}
 /**
 * Create a new {@link DataRouter| data router} that manages the application
 * path via [`history.pushState`](https://developer.mozilla.org/en-US/docs/Web/API/History/pushState)
@@ -123,7 +123,7 @@ function deserializeErrors(errors) {
 				let error = new ErrorConstructor(val.message);
 				error.stack = "";
 				serialized[key] = error;
-			} catch (e) {}
+			} catch {}
 		}
 		if (serialized[key] == null) {
 			let error = new Error(val.message);
@@ -796,6 +796,7 @@ function useSubmit() {
 		if (options.navigate === false) await routerFetch(options.fetcherKey || getUniqueFetcherId(), currentRouteId, options.action || action, {
 			defaultShouldRevalidate: options.defaultShouldRevalidate,
 			preventScrollReset: options.preventScrollReset,
+			relative: options.relative,
 			formData,
 			body,
 			formMethod: options.method || method,
@@ -805,6 +806,7 @@ function useSubmit() {
 		else await routerNavigate(options.action || action, {
 			defaultShouldRevalidate: options.defaultShouldRevalidate,
 			preventScrollReset: options.preventScrollReset,
+			relative: options.relative,
 			formData,
 			body,
 			formMethod: options.method || method,
@@ -1087,6 +1089,9 @@ function useScrollRestoration({ getKey, storageKey } = {}) {
 			window.history.scrollRestoration = "auto";
 		};
 	}, []);
+	usePageShow(React$1.useCallback((event) => {
+		if (event.persisted) window.history.scrollRestoration = "manual";
+	}, []));
 	usePageHide(React$1.useCallback(() => {
 		if (navigation.state === "idle") {
 			let key = getScrollRestorationKey(location, matches, basename, getKey);
@@ -1111,7 +1116,7 @@ function useScrollRestoration({ getKey, storageKey } = {}) {
 			try {
 				let sessionPositions = sessionStorage.getItem(storageKey || SCROLL_RESTORATION_STORAGE_KEY);
 				if (sessionPositions) savedScrollPositions = JSON.parse(sessionPositions);
-			} catch (e) {}
+			} catch {}
 		}, [storageKey]);
 		React$1.useLayoutEffect(() => {
 			let disableScrollRestoration = router?.enableScrollRestoration(savedScrollPositions, () => window.scrollY, getKey ? (location, matches) => getScrollRestorationKey(location, matches, basename, getKey) : void 0);
@@ -1179,6 +1184,16 @@ function usePageHide(callback, options) {
 		};
 	}, [callback, capture]);
 }
+function usePageShow(callback, options) {
+	let { capture } = options || {};
+	React$1.useEffect(() => {
+		let opts = capture != null ? { capture } : void 0;
+		window.addEventListener("pageshow", callback, opts);
+		return () => {
+			window.removeEventListener("pageshow", callback, opts);
+		};
+	}, [callback, capture]);
+}
 /**
 * Wrapper around {@link useBlocker} to show a [`window.confirm`](https://developer.mozilla.org/en-US/docs/Web/API/Window/confirm)
 * prompt to users instead of building a custom UI with {@link useBlocker}.

package/dist/production/lib/dom/server.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/dom/ssr/components.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -425,7 +425,7 @@ function Meta() {
 				type: "application/ld+json",
 				dangerouslySetInnerHTML: { __html: escapeHtml(json) }
 			});
-		} catch (e) {
+		} catch {
 			return null;
 		}
 		return /* @__PURE__ */ React$1.createElement("meta", {

package/dist/production/lib/dom/ssr/data.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/dom/ssr/errorBoundaries.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/dom/ssr/fallback.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/dom/ssr/fog-of-war.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -154,6 +154,7 @@ async function fetchAndApplyManifestPatches(paths, errorReloadPath, manifest, ro
 		if (signal?.aborted) return;
 		throw e;
 	}
+	if (signal?.aborted) return;
 	let knownRoutes = new Set(Object.keys(manifest.routes));
 	let patches = Object.values(serverPatches).reduce((acc, route) => {
 		if (route && !knownRoutes.has(route.id)) acc[route.id] = route;

package/dist/production/lib/dom/ssr/hydration.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/dom/ssr/invariant.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/dom/ssr/links.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/dom/ssr/markup.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/dom/ssr/routeModules.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/dom/ssr/routes-test-stub.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/dom/ssr/routes.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/dom/ssr/server.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/dom/ssr/single-fetch.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -205,7 +205,7 @@ async function bubbleMiddlewareErrors(singleFetchPromise, matches, routesParams,
 		if (middlewareError !== void 0) Array.from(routesParams.values()).forEach((routeId) => {
 			if (results[routeId].result instanceof SingleFetchNoResultError) results[routeId].result = middlewareError;
 		});
-	} catch (e) {}
+	} catch {}
 }
 async function singleFetchLoaderFetcherStrategy(args, fetchAndDecode) {
 	let fetcherMatch = args.matches.find((m) => m.shouldCallHandler());
@@ -277,7 +277,7 @@ async function fetchAndDecodeViaTurboStream(args, targetRoutes) {
 			status: res.status,
 			data
 		};
-	} catch (e) {
+	} catch {
 		throw new Error("Unable to decode turbo-stream response");
 	}
 }
@@ -326,13 +326,13 @@ function createDeferred() {
 			res(val);
 			try {
 				await promise;
-			} catch (e) {}
+			} catch {}
 		};
 		reject = async (error) => {
 			rej(error);
 			try {
 				await promise;
-			} catch (e) {}
+			} catch {}
 		};
 	});
 	return {

package/dist/production/lib/dom-export/dom-router-provider.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/dom-export/hydrated-router.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/errors.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/hooks.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -8,8 +8,9 @@
  *
  * @license MIT
  */
-import { invariant, parsePath, warning } from "./router/history.js";
+import { createPath, invariant, parsePath, warning } from "./router/history.js";
 import { convertRouteMatchToUiMatch, decodePath, getResolveToMatches, getRoutePattern, isBrowser, isRouteErrorResponse, joinPaths, matchPath, matchRoutes, parseToInfo, resolveTo, stripBasename } from "./router/utils.js";
+import { getNavigatorCurrentUrl, validateNavigationTarget } from "./router/navigation.js";
 import { IDLE_BLOCKER, hasInvalidProtocol } from "./router/router.js";
 import { AwaitContext, DataRouterContext, DataRouterStateContext, LocationContext, NavigationContext, RSCRouterContext, RouteContext, RouteErrorContext } from "./context.js";
 import { decodeRedirectErrorDigest, decodeRouteErrorResponseDigest } from "./errors.js";
@@ -291,6 +292,7 @@ function useNavigateUnstable() {
 		}
 		let path = resolveTo(to, JSON.parse(routePathnamesJson), locationPathname, options.relative === "path");
 		if (dataRouterContext == null && basename !== "/") path.pathname = path.pathname === "/" ? basename : joinPaths([basename, path.pathname]);
+		validateNavigationTarget(typeof to === "string" ? to : createPath(to), navigator.createHref(path), getNavigatorCurrentUrl(navigator), "reject");
 		(!!options.replace ? navigator.replace : navigator.push)(path, options.state, options);
 	}, [
 		basename,
@@ -672,7 +674,7 @@ var RenderErrorBoundary = class extends React$1.Component {
 };
 const errorRedirectHandledMap = /* @__PURE__ */ new WeakMap();
 function RSCErrorHandler({ children, error }) {
-	let { basename } = React$1.useContext(NavigationContext);
+	let { basename, navigator } = React$1.useContext(NavigationContext);
 	if (typeof error === "object" && error && "digest" in error && typeof error.digest === "string") {
 		let redirect = decodeRedirectErrorDigest(error.digest);
 		if (redirect) {
@@ -680,6 +682,7 @@ function RSCErrorHandler({ children, error }) {
 			if (existingRedirect) throw existingRedirect;
 			let parsed = parseToInfo(redirect.location, basename);
 			let target = parsed.absoluteURL || parsed.to;
+			validateNavigationTarget(redirect.location, target, getNavigatorCurrentUrl(navigator), "allow-explicit");
 			if (hasInvalidProtocol(target)) throw new Error("Invalid redirect location");
 			if (isBrowser && !errorRedirectHandledMap.get(error)) if (parsed.isExternal || redirect.reloadDocument) window.location.href = target;
 			else {

package/dist/production/lib/href.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/router/history.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -193,7 +193,7 @@ function warning(cond, message) {
 		if (typeof console !== "undefined") console.warn(message);
 		try {
 			throw new Error(message);
-		} catch (e) {}
+		} catch {}
 	}
 }
 function createKey() {

package/dist/production/lib/router/instrumentation.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/router/navigation.js

@@ -0,0 +1,45 @@
+/**
+ * react-router v8.3.1
+ *
+ * Copyright (c) Remix Software Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE.md file in the root directory of this source tree.
+ *
+ * @license MIT
+ */
+//#region lib/router/navigation.ts
+const DEFAULT_NAVIGATION_URL = new URL("http://localhost");
+function getNavigatorCurrentUrl(navigator) {
+	if (navigator.createURL) return navigator.createURL("/");
+	try {
+		return new URL(navigator.createHref("/"), DEFAULT_NAVIGATION_URL);
+	} catch {
+		return DEFAULT_NAVIGATION_URL;
+	}
+}
+function isSameOrigin(a, b) {
+	return a.origin === b.origin && (a.origin !== "null" || a.protocol === b.protocol && a.host === b.host);
+}
+function isExplicitUrl(destination, target) {
+	if (destination.startsWith("//")) return true;
+	let protocol = target.protocol.toLowerCase();
+	if (!destination.toLowerCase().startsWith(protocol)) return false;
+	return target.host === "" || destination.slice(protocol.length).startsWith("//");
+}
+function validateNavigationTarget(original, resolved, currentUrl, externalPolicy) {
+	let originalUrl = null;
+	try {
+		originalUrl = original == null ? null : new URL(original, currentUrl);
+	} catch {}
+	let resolvedUrl = new URL(resolved, currentUrl);
+	let originalIsExternal = originalUrl != null && !isSameOrigin(originalUrl, currentUrl);
+	let resolvedIsExternal = !isSameOrigin(resolvedUrl, currentUrl);
+	if (externalPolicy === "reject") {
+		if (originalIsExternal || resolvedIsExternal) throw new Error("External navigation is not allowed");
+	} else if (resolvedIsExternal) {
+		if (originalUrl == null || !isExplicitUrl(original, originalUrl) || !isSameOrigin(originalUrl, resolvedUrl)) throw new Error("External navigation is not allowed");
+	}
+}
+//#endregion
+export { getNavigatorCurrentUrl, validateNavigationTarget };

package/dist/production/lib/router/router.d.ts

@@ -128,6 +128,14 @@ interface Router {
    * @param location
    */
   createHref(location: Location | URL): string;
+  /**
+   * @private
+   * PRIVATE - DO NOT USE
+   *
+   * Utility function to create a URL for the given location
+   * @param location
+   */
+  createURL?(to: To): URL;
   /**
    * @private
    * PRIVATE - DO NOT USE