Fix trailing slash redirect to external domain (#358)

* fix trailing slash redirect to external domain

* changeset

.changeset/tame-hotels-tell.md

@@ -0,0 +1,6 @@
+---
+"open-next": patch
+"tests-e2e": patch
+---
+
+Fix trailing slash redirect to external domain

packages/open-next/src/adapters/routing/matcher.ts

@@ -169,11 +169,13 @@ export function handleRewrites<T extends RewriteDefinition>(
   };
 }
 
-export function handleRedirects(
-  event: InternalEvent,
-  redirects: RedirectDefinition[],
-): InternalResult | undefined {
+function handleTrailingSlashRedirect(event: InternalEvent) {
   if (!NextConfig.skipTrailingSlashRedirect) {
+    const url = new URL(event.url, "http://localhost");
+    // Someone is trying to redirect to a different origin, let's not do that
+    if (url.host !== "localhost") {
+      return false;
+    }
     if (
       NextConfig.trailingSlash &&
       !event.headers["x-nextjs-data"] &&
@@ -211,7 +213,15 @@ export function handleRedirects(
         isBase64Encoded: false,
       };
     }
-  }
+  } else return false;
+}
+
+export function handleRedirects(
+  event: InternalEvent,
+  redirects: RedirectDefinition[],
+): InternalResult | undefined {
+  const trailingSlashRedirect = handleTrailingSlashRedirect(event);
+  if (trailingSlashRedirect) return trailingSlashRedirect;
   const { internalEvent, __rewrite } = handleRewrites(
     event,
     redirects.filter((r) => !r.internal),

packages/tests-e2e/tests/appRouter/trailing.test.ts

@@ -15,3 +15,8 @@ test("trailingSlash redirect with search parameters", async ({ page }) => {
   );
   expect(response?.request().url()).toMatch(/\/ssr\?happy=true$/);
 });
+
+test("trailingSlash redirect to external domain", async ({ page, baseURL }) => {
+  const response = await page.goto(`${baseURL}//sst.dev/`);
+  expect(response?.status()).toBe(404);
+});