Something went wrong. Try again.
Monorepo for Tangled forked from tangled.org/core
Something went wrong. Try again.
12345678910111213141516171819202122// post-login targets are attacker-controlled (login links, stored pending// state), so resolve against an opaque origin and only accept paths that// stay on it. also covers network-path forms like "/\evil.com" that the url// parser turns into a foreign hostconst SAFE_BASE = "https://return-to.invalid";
export const internalUrl = (value: unknown): URL | null => { if (typeof value !== "string" || value.trim() === "") return null; let resolved: URL; try { resolved = new URL(value, SAFE_BASE); } catch { return null; } return resolved.origin === SAFE_BASE ? resolved : null;};
export const safeReturnTo = (value: unknown): string => { const resolved = internalUrl(value); return resolved ? `${resolved.pathname}${resolved.search}${resolved.hash}` : "/";};