Improved absolute redirect url detection in actions/loaders (#9829)

remix-run · Jan 11, 2023 · c0f1b98 · c0f1b98
1 parent 7951edc
commit c0f1b98
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 2 deletions.
diff --git a/contributors.yml b/contributors.yml
@@ -96,6 +96,7 @@
 - latin-1
 - lequangdongg
 - liuhanqu
+- lkwr
 - lopezac
 - lordofthecactus
 - loun4

diff --git a/packages/router/__tests__/router-test.ts b/packages/router/__tests__/router-test.ts
@@ -11363,6 +11363,8 @@ describe("a router", () => {
           "https://remix.run/blog",
           "//remix.run/blog",
           "app://whatever",
+          "mailto:[email protected]",
+          "web+remix:whatever",
         ];
 
         for (let url of urls) {

diff --git a/packages/router/router.ts b/packages/router/router.ts
@@ -2832,8 +2832,7 @@ async function callLoaderOrAction(
         "Redirects returned/thrown from loaders/actions must have a Location header"
       );
 
-      let isAbsolute =
-        /^[a-z+]+:\/\//i.test(location) || location.startsWith("//");
+      let isAbsolute = /^(?:[a-z][a-z0-9+.-]*:|\/\/)/i.test(location);
 
       // Support relative routing in internal redirects
       if (!isAbsolute) {