| 1 | |
| 2 | |
| 3 | |
| 4 | |
| 5 | |
| 6 | |
| 7 | |
| 8 | |
| 9 | |
| 10 |
|
| 11 |
|
| 12 | const DEFAULT_NAVIGATION_URL = new URL("http://localhost");
|
| 13 | function getNavigatorCurrentUrl(navigator) {
|
| 14 | if (navigator.createURL) return navigator.createURL("/");
|
| 15 | try {
|
| 16 | return new URL(navigator.createHref("/"), DEFAULT_NAVIGATION_URL);
|
| 17 | } catch {
|
| 18 | return DEFAULT_NAVIGATION_URL;
|
| 19 | }
|
| 20 | }
|
| 21 | function isSameOrigin(a, b) {
|
| 22 | return a.origin === b.origin && (a.origin !== "null" || a.protocol === b.protocol && a.host === b.host);
|
| 23 | }
|
| 24 | function isExplicitUrl(destination, target) {
|
| 25 | if (destination.startsWith("//")) return true;
|
| 26 | let protocol = target.protocol.toLowerCase();
|
| 27 | if (!destination.toLowerCase().startsWith(protocol)) return false;
|
| 28 | return target.host === "" || destination.slice(protocol.length).startsWith("//");
|
| 29 | }
|
| 30 | function validateNavigationTarget(original, resolved, currentUrl, externalPolicy) {
|
| 31 | let originalUrl = null;
|
| 32 | try {
|
| 33 | originalUrl = original == null ? null : new URL(original, currentUrl);
|
| 34 | } catch {}
|
| 35 | let resolvedUrl = new URL(resolved, currentUrl);
|
| 36 | let originalIsExternal = originalUrl != null && !isSameOrigin(originalUrl, currentUrl);
|
| 37 | let resolvedIsExternal = !isSameOrigin(resolvedUrl, currentUrl);
|
| 38 | if (externalPolicy === "reject") {
|
| 39 | if (originalIsExternal || resolvedIsExternal) throw new Error("External navigation is not allowed");
|
| 40 | } else if (resolvedIsExternal) {
|
| 41 | if (originalUrl == null || !isExplicitUrl(original, originalUrl) || !isSameOrigin(originalUrl, resolvedUrl)) throw new Error("External navigation is not allowed");
|
| 42 | }
|
| 43 | }
|
| 44 |
|
| 45 | export { getNavigatorCurrentUrl, validateNavigationTarget };
|