fix(history): prevent open redirect via backslash protocol-relative URLs

[contactjawad]

Summary

sanitizePath guards against open redirects via protocol-relative URLs by collapsing leading // (e.g. //evil.com → /evil.com), but it only handled forward slashes. Per the WHATWG URL spec, browsers treat backslashes as forward slashes in the authority of a special-scheme URL, so the following all bypassed the guard and resolved cross-origin:

• \\evil.com/path
• /\evil.com/path
• \/evil.com/path

Fix

Collapse any run of two or more leading slashes or backslashes to a single slash:

if (/^[/\\]{2,}/.test(sanitized)) {
  sanitized = '/' + sanitized.replace(/^[/\\]+/, '')
}

The existing // behavior is unchanged; single leading slashes/backslashes (same-origin paths) are untouched.

Test

Extended the open redirect prevention block in parseHref.test.ts with a case covering the three backslash variants, asserting the pathname collapses to /evil.com/path and the resolved URL stays same-origin. It fails on main (the backslashes are left intact, so the resolved origin becomes evil.com) and passes with this change. A changeset is included.

Summary by CodeRabbit

• Bug Fixes
  • Improved path sanitization to prevent open redirects caused by leading backslashes.
  • Leading combinations of slashes and backslashes are now normalized to a safe same-origin path.
  • Added regression coverage for backslash-based protocol-relative URL variants.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a9eeb21f-e893-4a26-a149-f91264a1dd66

📥 Commits

Reviewing files that changed from the base of the PR and between a78f2af and ab28428.

📒 Files selected for processing (3)

• .changeset/fix-sanitizepath-backslash.md
• packages/history/src/index.ts
• packages/history/tests/parseHref.test.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

sanitizePath now collapses leading runs of slashes and backslashes to one slash. Tests cover backslash variants and confirm same-origin resolution. A patch changeset documents the fix.

Changes

SanitizePath hardening

Layer / File(s)	Summary
Normalize leading path separators packages/history/src/index.ts, packages/history/tests/parseHref.test.ts, .changeset/fix-sanitizepath-backslash.md	sanitizePath normalizes leading slash and backslash runs. Regression tests cover mixed separator variants and same-origin resolution. The changeset documents the patch.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to ab284

This localized security fix normalizes backslash-based protocol-relative paths while preserving existing behavior, with tests covering the affected variants; no actionable merge-blocking risk remains after normal checks and review.

Possibly related PRs

• TanStack/router#8089: Both PRs modify sanitizePath/parseHref behavior and tests in packages/history.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main security fix for backslash-based protocol-relative URL open redirects.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}