@kentcdodds/tmp-remix-utils
Version:
This package contains simple utility functions to use with [Remix.run](https://remix.run).
24 lines (23 loc) • 699 B
JavaScript
const DEFAULT_REDIRECT = "/";
/**
* This should be used any time the redirect path is user-provided
* (Like the query string on our login/signup pages). This avoids
* open-redirect vulnerabilities.
* @param {string} to The redirect destination
* @param {string} defaultRedirect The redirect to use if the to is unsafe.
* @license MIT
* @author https://github.com/jacob-ebey
*/
export function safeRedirect(to, defaultRedirect = DEFAULT_REDIRECT) {
if (!to || typeof to !== "string") return defaultRedirect;
to = to.trim();
if (
!to.startsWith("/") ||
to.startsWith("//") ||
to.startsWith("/\\") ||
to.includes("..")
) {
return defaultRedirect;
}
return to;
}