fix: hardening#6337

Merged

schiller-manuel merged 16 commits intomainfrom

Jan 8, 2026

Commits on Jan 8, 2026

fix: resolveRedirect normalizes same-origin Location to path-only
schiller-manuel
committed
fix: do not trust Origin header for router origin determination
schiller-manuel
committed
fix: block dangerous URL protocols in navigate and redirect
schiller-manuel
committed
fix: block external spa maskPath during prerender
schiller-manuel
committed
fix: block prerender external page SSRF
schiller-manuel
committed
fix: add HTML escaping to prevent XSS in scroll restoration options
schiller-manuel
committed
fix: block dangerous protocols for external links
schiller-manuel
committed
fix: escape JSON-LD structured data to prevent XSS in head tags
schiller-manuel
committed
formatting & lint
schiller-manuel
committed
fix: enforce relative paths for prerender page paths and improve error handling
schiller-manuel
committed
test: add edge cases for isDangerousProtocol function
schiller-manuel
committed
fix: refactor prerender page path validation to use a dedicated normalization function
schiller-manuel
committed
fix: preserve unicode characters in prerender page paths by decoding pathname
schiller-manuel
committed
test: enhance mocks for vite and fs in prerender SSRF tests
schiller-manuel
committed
fix tests
schiller-manuel
committed
test: update spa configuration in makeStartConfig for prerender settings
schiller-manuel
committed