diff --git a/.changeset/curvy-foxes-change.md b/.changeset/curvy-foxes-change.md new file mode 100644 index 000000000000..9238a723af1a --- /dev/null +++ b/.changeset/curvy-foxes-change.md @@ -0,0 +1,5 @@ +--- +'@sveltejs/kit': patch +--- + +[fix] don't redirect to external URLs when normalizing paths diff --git a/packages/kit/src/runtime/server/index.js b/packages/kit/src/runtime/server/index.js index ce6a8ca3e76f..51c29a82306b 100644 --- a/packages/kit/src/runtime/server/index.js +++ b/packages/kit/src/runtime/server/index.js @@ -22,7 +22,10 @@ export async function respond(request, options, state) { return new Response(undefined, { status: 301, headers: { - location: normalized + (url.search === '?' ? '' : url.search) + location: + // ensure paths starting with '//' are not treated as protocol-relative + (normalized.startsWith('//') ? url.origin + normalized : normalized) + + (url.search === '?' ? '' : url.search) } }); }