[fix] don't redirect to external URLs when normalizing paths (#4414)

sveltejs · Mar 22, 2022 · 32a700a · 32a700a
1 parent 2865f41
commit 32a700a
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 1 deletion.
diff --git a/.changeset/curvy-foxes-change.md b/.changeset/curvy-foxes-change.md
@@ -0,0 +1,5 @@
+---
+'@sveltejs/kit': patch
+---
+
+[fix] don't redirect to external URLs when normalizing paths
diff --git a/packages/kit/src/runtime/server/index.js b/packages/kit/src/runtime/server/index.js
@@ -22,7 +22,10 @@ export async function respond(request, options, state) {
 		return new Response(undefined, {
 			status: 301,
 			headers: {
-				location: normalized + (url.search === '?' ? '' : url.search)
+				location:
+					// ensure paths starting with '//' are not treated as protocol-relative
+					(normalized.startsWith('//') ? url.origin + normalized : normalized) +
+					(url.search === '?' ? '' : url.search)
 			}
 		});
 	}