fix trailing slash redirect to external domain

opennextjs · Feb 1, 2024 · 016aaa6 · 016aaa6
1 parent afd9605
commit 016aaa6
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 5 deletions.
diff --git a/packages/open-next/src/adapters/routing/matcher.ts b/packages/open-next/src/adapters/routing/matcher.ts
@@ -169,11 +169,13 @@ export function handleRewrites<T extends RewriteDefinition>(
   };
 }
 
-export function handleRedirects(
-  event: InternalEvent,
-  redirects: RedirectDefinition[],
-): InternalResult | undefined {
+function handleTrailingSlashRedirect(event: InternalEvent) {
   if (!NextConfig.skipTrailingSlashRedirect) {
+    const url = new URL(event.url, "http://localhost");
+    // Someone is trying to redirect to a different origin, let's not do that
+    if (url.host !== "localhost") {
+      return false;
+    }
     if (
       NextConfig.trailingSlash &&
       !event.headers["x-nextjs-data"] &&
@@ -211,7 +213,15 @@ export function handleRedirects(
         isBase64Encoded: false,
       };
     }
-  }
+  } else return false;
+}
+
+export function handleRedirects(
+  event: InternalEvent,
+  redirects: RedirectDefinition[],
+): InternalResult | undefined {
+  const trailingSlashRedirect = handleTrailingSlashRedirect(event);
+  if (trailingSlashRedirect) return trailingSlashRedirect;
   const { internalEvent, __rewrite } = handleRewrites(
     event,
     redirects.filter((r) => !r.internal),

diff --git a/packages/tests-e2e/tests/appRouter/trailing.test.ts b/packages/tests-e2e/tests/appRouter/trailing.test.ts
@@ -15,3 +15,8 @@ test("trailingSlash redirect with search parameters", async ({ page }) => {
   );
   expect(response?.request().url()).toMatch(/\/ssr\?happy=true$/);
 });
+
+test("trailingSlash redirect to external domain", async ({ page, baseURL }) => {
+  const response = await page.goto(`${baseURL}//sst.dev/`);
+  expect(response?.status()).toBe(404);
+});