breaking: disallow external navigation using goto

.changeset/silent-games-taste.md

@@ -0,0 +1,5 @@
+---
+'@sveltejs/kit': major
+---
+
+breaking: disallow external navigation with `goto`

packages/kit/src/exports/public.d.ts

@@ -846,7 +846,7 @@ export interface Navigation {
 	/**
 	 * The type of navigation:
 	 * - `form`: The user submitted a `<form>`
-	 * - `leave`: The user is leaving the app by closing the tab or using the back/forward buttons to go to a different document
+	 * - `leave`: The app is being left either because the tab is being closed or a navigation to a different document is occurring
 	 * - `link`: Navigation was triggered by a link click
 	 * - `goto`: Navigation was triggered by a `goto(...)` call or a redirect
 	 * - `popstate`: Navigation was triggered by back/forward navigation

packages/kit/src/runtime/app/navigation.js

@@ -23,7 +23,7 @@ export const disableScrollHandling = /* @__PURE__ */ client_method('disable_scro
  * @param {boolean} [opts.replaceState] If `true`, will replace the current `history` entry rather than creating a new one with `pushState`
  * @param {boolean} [opts.noScroll] If `true`, the browser will maintain its scroll position rather than scrolling to the top of the page after navigation
  * @param {boolean} [opts.keepFocus] If `true`, the currently focused element will retain focus after navigation. Otherwise, focus will be reset to the body
- * @param {boolean} [invalidateAll] If `true`, all `load` functions of the page will be rerun. See https://kit.svelte.dev/docs/load#rerunning-load-functions for more info on invalidation.
+ * @param {boolean} [opts.invalidateAll] If `true`, all `load` functions of the page will be rerun. See https://kit.svelte.dev/docs/load#rerunning-load-functions for more info on invalidation.
  * @param {any} [opts.state] The state of the new/updated history entry
  * @returns {Promise<void>}
  */

packages/kit/src/runtime/client/client.js

@@ -1376,6 +1376,19 @@ export function create_client(app, target) {
 		},
 
 		goto: (href, opts = {}) => {
+			if (typeof href === 'string') {
+				href = new URL(href, get_base_uri(document));
+			}
+			if (href.origin !== origin) {
+				return Promise.reject(
+					new Error(
+						DEV
+							? `Cannot use \`goto\` with an external URL. Use \`window.location = "${href}"\` instead`
+							: 'Invalid URL'
+					)
+				);
+			}
+
 			return goto(href, opts, 0);
 		},
 

packages/kit/test/apps/basics/src/routes/goto/+page.svelte

@@ -0,0 +1,17 @@
+<script>
+	import { goto } from '$app/navigation';
+
+	let message = '...';
+</script>
+
+<button
+	on:click={async () => {
+		try {
+			await goto('https://example.com');
+		} catch (e) {
+			message = e.message;
+		}
+	}}>goto</button
+>
+
+<p>{message}</p>

packages/kit/test/apps/basics/test/client.test.js

@@ -841,3 +841,15 @@ test.describe('Assets', () => {
 		).toBe(true);
 	});
 });
+
+test.describe('goto', () => {
+	test('goto fails with external URL', async ({ page }) => {
+		await page.goto('/goto');
+		await page.click('button');
+
+		const message = process.env.DEV
+			? 'Cannot use `goto` with an external URL. Use `window.location = "https://example.com/"` instead'
+			: 'Invalid URL';
+		await expect(page.locator('p')).toHaveText(message);
+	});
+});

packages/kit/test/apps/basics/test/cross-platform/client.test.js

@@ -141,17 +141,6 @@
 		expect(await page.innerHTML('pre')).toBe('1 false goto');
 	});
 
-	test('beforeNavigate prevents external navigation triggered by goto', async ({
-		page,
-		app,
-		baseURL
-	}) => {
-		await page.goto('/navigation-lifecycle/before-navigate/prevent-navigation');
-		await app.goto('https://google.de');
-		expect(page.url()).toBe(baseURL + '/navigation-lifecycle/before-navigate/prevent-navigation');
-		expect(await page.innerHTML('pre')).toBe('1 true goto');
-	});
-
 	test('beforeNavigate prevents navigation triggered by back button', async ({
 		page,
 		app,
@@ -215,8 +204,11 @@
 	}) => {
 		await page.goto('/navigation-lifecycle/before-navigate/prevent-navigation');
 		await page.click('h1'); // The browsers block attempts to prevent navigation on a frame that's never had a user gesture.
-
-		await app.goto('https://google.de');
+		page.on('dialog', async (dialog) => {
+			await dialog.dismiss();
+		});
+		await page.close({ runBeforeUnload: true });
+		await page.waitForTimeout(100);
 		await app.goto('/navigation-lifecycle/before-navigate/prevent-navigation?x=1');
 
 		expect(await page.innerHTML('pre')).toBe('2 false goto');
@@ -678,7 +670,7 @@
 		const { port } = await start_server((_req, res) => {
 			res.end(html_ok);
 		});
 
 		await page.goto(`/routing/slashes?port=${port}`);
 		await page.locator(`a[href="http://localhost:${port}/with-slash/"]`).click();
 		expect(await page.content()).toBe(html_ok);