Skip to content

Commit 6b28d99

Browse files
committed
fix(solid-router): skip URL parsing for safe 'to' props
1 parent 0592d49 commit 6b28d99

File tree

1 file changed

+10
-4
lines changed

1 file changed

+10
-4
lines changed

packages/solid-router/src/link.tsx

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -167,16 +167,22 @@ export function useLinkProps<
167167
}
168168
return _href.href
169169
}
170+
const to = _options().to
171+
const isSafeInternal =
172+
typeof to === 'string' &&
173+
to.charCodeAt(0) === 47 && // '/'
174+
to.charCodeAt(1) !== 47 // but not '//'
175+
if (isSafeInternal) return undefined
170176
try {
171-
new URL(_options().to as any)
177+
new URL(to as any)
172178
// Block dangerous protocols like javascript:, data:, vbscript:
173-
if (isDangerousProtocol(_options().to as string)) {
179+
if (isDangerousProtocol(to as string)) {
174180
if (process.env.NODE_ENV !== 'production') {
175-
console.warn(`Blocked Link with dangerous protocol: ${_options().to}`)
181+
console.warn(`Blocked Link with dangerous protocol: ${to}`)
176182
}
177183
return undefined
178184
}
179-
return _options().to
185+
return to
180186
} catch {}
181187
return undefined
182188
})

0 commit comments

Comments
 (0)