fix: hardening - #6337

Merged

schiller-manuel merged 16 commits into

mainfrom

Jan 8, 2026

Commits on Jan 8, 2026

fix: resolveRedirect normalizes same-origin Location to path-only
schiller-manuel
committed
92b5e93
fix: do not trust Origin header for router origin determination
schiller-manuel
committed
7886bda
fix: block dangerous URL protocols in navigate and redirect
schiller-manuel
committed
76fbc42
fix: block external spa maskPath during prerender
schiller-manuel
committed
47ab005
fix: block prerender external page SSRF
schiller-manuel
committed
d86f465
fix: add HTML escaping to prevent XSS in scroll restoration options
schiller-manuel
committed
a7b86bc
fix: block dangerous protocols for external links
schiller-manuel
committed
63e4a8e
fix: escape JSON-LD structured data to prevent XSS in head tags
schiller-manuel
committed
ca5971c
formatting & lint
schiller-manuel
committed
d32bf01
fix: enforce relative paths for prerender page paths and improve error handling
schiller-manuel
committed
0951c28
test: add edge cases for isDangerousProtocol function
schiller-manuel
committed
55b0f52
fix: refactor prerender page path validation to use a dedicated normalization function
schiller-manuel
committed
a06d9dd
fix: preserve unicode characters in prerender page paths by decoding pathname
schiller-manuel
committed
3719b02
test: enhance mocks for vite and fs in prerender SSRF tests
schiller-manuel
committed
6ae0893
fix tests
schiller-manuel
committed
2125eb6
test: update spa configuration in makeStartConfig for prerender settings
schiller-manuel
committed
72bb09d