From 6b28d99d379af6b1b72ed38d6be3721acf2f086d Mon Sep 17 00:00:00 2001 From: Sheraff Date: Thu, 22 Jan 2026 13:36:19 +0100 Subject: [PATCH] fix(solid-router): skip URL parsing for safe 'to' props --- packages/solid-router/src/link.tsx | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/packages/solid-router/src/link.tsx b/packages/solid-router/src/link.tsx index 04ddc655960..5c266063a45 100644 --- a/packages/solid-router/src/link.tsx +++ b/packages/solid-router/src/link.tsx @@ -167,16 +167,22 @@ export function useLinkProps< } return _href.href } + const to = _options().to + const isSafeInternal = + typeof to === 'string' && + to.charCodeAt(0) === 47 && // '/' + to.charCodeAt(1) !== 47 // but not '//' + if (isSafeInternal) return undefined try { - new URL(_options().to as any) + new URL(to as any) // Block dangerous protocols like javascript:, data:, vbscript: - if (isDangerousProtocol(_options().to as string)) { + if (isDangerousProtocol(to as string)) { if (process.env.NODE_ENV !== 'production') { - console.warn(`Blocked Link with dangerous protocol: ${_options().to}`) + console.warn(`Blocked Link with dangerous protocol: ${to}`) } return undefined } - return _options().to + return to } catch {} return undefined })