feat(router-core, react-router, solid-router, vue-router): isDangerousProtocol uses customizable blocklist #6542

Sheraff · 2026-01-28T23:13:47Z

there can be an infinity of protocols (custom protocols are a thing)
blob: and data: are widely used protocols (so we should have a way to allow them), but they can also be considered dangerous if displaying untrusted links (so we should have a way to block them)
an allowlist is usually a better security practice than a blocklist
causing security issues is bad (block everything)
breaking links on the web is bad (allow everything)

List of CVEs about unsafe URL protocols:

https://www.cve.org/CVERecord?id=CVE-2025-57665 (same as us, mentions javascript:, data:, file:)
https://www.cve.org/CVERecord?id=CVE-2025-31477 (tauri, mentions file:, smb:, or nfs:)
https://www.cve.org/CVERecord?id=CVE-2025-56200 (improper parsing, i think we're good here)
https://www.cve.org/CVERecord?id=CVE-2024-37359 (server side, might not be relevant to us)
https://www.cve.org/CVERecord?id=CVE-2024-34343 (nuxt, improper parsing, we're good here)
https://www.cve.org/CVERecord?id=CVE-2024-28175 (mentions javascript:)

Summary by CodeRabbit

New Features
- Added configurable protocolBlocklist option to RouterOptions across React Router, Solid Router, and Vue Router. Users can now customize which URL protocols are blocked for links, redirects, and navigation.
- Exposed DEFAULT_PROTOCOL_BLOCKLIST as a public constant for reference when customizing protocol blocking behavior.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

…sProtocol uses customizable blocklist

coderabbitai · 2026-01-28T23:14:10Z

📝 Walkthrough

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 40.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately and specifically describes the main change: implementing a customizable blocklist for the isDangerousProtocol function across multiple router packages.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

📝 Generate docstrings

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

nx-cloud · 2026-01-28T23:14:18Z

View your CI Pipeline Execution ↗ for commit 0783869

Command	Status	Duration	Result
`nx affected --targets=test:eslint,test:unit,tes...`	✅ Succeeded	11m 5s	View ↗
`nx run-many --target=build --exclude=examples/*...`	✅ Succeeded	1m 27s	View ↗

☁️ Nx Cloud last updated this comment at 2026-01-28 23:32:13 UTC

pkg-pr-new · 2026-01-28T23:17:30Z

More templates

@tanstack/arktype-adapter

npm i https://pkg.pr.new/TanStack/router/@tanstack/arktype-adapter@6542

@tanstack/eslint-plugin-router

npm i https://pkg.pr.new/TanStack/router/@tanstack/eslint-plugin-router@6542

@tanstack/history

npm i https://pkg.pr.new/TanStack/router/@tanstack/history@6542

@tanstack/nitro-v2-vite-plugin

npm i https://pkg.pr.new/TanStack/router/@tanstack/nitro-v2-vite-plugin@6542

@tanstack/react-router

npm i https://pkg.pr.new/TanStack/router/@tanstack/react-router@6542

@tanstack/react-router-devtools

npm i https://pkg.pr.new/TanStack/router/@tanstack/react-router-devtools@6542

@tanstack/react-router-ssr-query

npm i https://pkg.pr.new/TanStack/router/@tanstack/react-router-ssr-query@6542

@tanstack/react-start

npm i https://pkg.pr.new/TanStack/router/@tanstack/react-start@6542

@tanstack/react-start-client

npm i https://pkg.pr.new/TanStack/router/@tanstack/react-start-client@6542

@tanstack/react-start-server

npm i https://pkg.pr.new/TanStack/router/@tanstack/react-start-server@6542

@tanstack/router-cli

npm i https://pkg.pr.new/TanStack/router/@tanstack/router-cli@6542

@tanstack/router-core

npm i https://pkg.pr.new/TanStack/router/@tanstack/router-core@6542

@tanstack/router-devtools

npm i https://pkg.pr.new/TanStack/router/@tanstack/router-devtools@6542

@tanstack/router-devtools-core

npm i https://pkg.pr.new/TanStack/router/@tanstack/router-devtools-core@6542

@tanstack/router-generator

npm i https://pkg.pr.new/TanStack/router/@tanstack/router-generator@6542

@tanstack/router-plugin

npm i https://pkg.pr.new/TanStack/router/@tanstack/router-plugin@6542

@tanstack/router-ssr-query-core

npm i https://pkg.pr.new/TanStack/router/@tanstack/router-ssr-query-core@6542

@tanstack/router-utils

npm i https://pkg.pr.new/TanStack/router/@tanstack/router-utils@6542

@tanstack/router-vite-plugin

npm i https://pkg.pr.new/TanStack/router/@tanstack/router-vite-plugin@6542

@tanstack/solid-router

npm i https://pkg.pr.new/TanStack/router/@tanstack/solid-router@6542

@tanstack/solid-router-devtools

npm i https://pkg.pr.new/TanStack/router/@tanstack/solid-router-devtools@6542

@tanstack/solid-router-ssr-query

npm i https://pkg.pr.new/TanStack/router/@tanstack/solid-router-ssr-query@6542

@tanstack/solid-start

npm i https://pkg.pr.new/TanStack/router/@tanstack/solid-start@6542

@tanstack/solid-start-client

npm i https://pkg.pr.new/TanStack/router/@tanstack/solid-start-client@6542

@tanstack/solid-start-server

npm i https://pkg.pr.new/TanStack/router/@tanstack/solid-start-server@6542

@tanstack/start-client-core

npm i https://pkg.pr.new/TanStack/router/@tanstack/start-client-core@6542

@tanstack/start-fn-stubs

npm i https://pkg.pr.new/TanStack/router/@tanstack/start-fn-stubs@6542

@tanstack/start-plugin-core

npm i https://pkg.pr.new/TanStack/router/@tanstack/start-plugin-core@6542

@tanstack/start-server-core

npm i https://pkg.pr.new/TanStack/router/@tanstack/start-server-core@6542

@tanstack/start-static-server-functions

npm i https://pkg.pr.new/TanStack/router/@tanstack/start-static-server-functions@6542

@tanstack/start-storage-context

npm i https://pkg.pr.new/TanStack/router/@tanstack/start-storage-context@6542

@tanstack/valibot-adapter

npm i https://pkg.pr.new/TanStack/router/@tanstack/valibot-adapter@6542

@tanstack/virtual-file-routes

npm i https://pkg.pr.new/TanStack/router/@tanstack/virtual-file-routes@6542

@tanstack/vue-router

npm i https://pkg.pr.new/TanStack/router/@tanstack/vue-router@6542

@tanstack/vue-router-devtools

npm i https://pkg.pr.new/TanStack/router/@tanstack/vue-router-devtools@6542

@tanstack/vue-router-ssr-query

npm i https://pkg.pr.new/TanStack/router/@tanstack/vue-router-ssr-query@6542

@tanstack/vue-start

npm i https://pkg.pr.new/TanStack/router/@tanstack/vue-start@6542

@tanstack/vue-start-client

npm i https://pkg.pr.new/TanStack/router/@tanstack/vue-start-client@6542

@tanstack/vue-start-server

npm i https://pkg.pr.new/TanStack/router/@tanstack/vue-start-server@6542

@tanstack/zod-adapter

npm i https://pkg.pr.new/TanStack/router/@tanstack/zod-adapter@6542

commit: 0783869

Sheraff · 2026-01-29T07:06:44Z

packages/router-core/src/redirect.ts

-  // Block dangerous protocols in redirect href
-  if (
-    !opts._builtLocation &&
-    typeof opts.href === 'string' &&
-    isDangerousProtocol(opts.href)
-  ) {
-    throw new Error(
-      `Redirect blocked: unsafe protocol in href "${opts.href}". Only ${SAFE_URL_PROTOCOLS.join(', ')} protocols are allowed.`,
-    )
-  }
-


We don't need to check here, since a redirect() is always handled by something else that will check, right?

feat(router-core, react-router, solid-router, vue-router): isDangerou…

6124547

…sProtocol uses customizable blocklist

github-actions bot added package: react-router package: router-core package: solid-router package: vue-router labels Jan 28, 2026

docs

0783869

github-actions bot added the documentation Everything documentation related label Jan 28, 2026

Sheraff commented Jan 29, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(router-core, react-router, solid-router, vue-router): isDangerousProtocol uses customizable blocklist #6542

feat(router-core, react-router, solid-router, vue-router): isDangerousProtocol uses customizable blocklist #6542

Sheraff commented Jan 28, 2026 •

edited

Loading

Uh oh!

coderabbitai bot commented Jan 28, 2026 •

edited

Loading

Uh oh!

nx-cloud bot commented Jan 28, 2026 •

edited

Loading

Uh oh!

pkg-pr-new bot commented Jan 28, 2026 •

edited

Loading

Uh oh!

Sheraff Jan 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

feat(router-core, react-router, solid-router, vue-router): isDangerousProtocol uses customizable blocklist #6542

Are you sure you want to change the base?

feat(router-core, react-router, solid-router, vue-router): isDangerousProtocol uses customizable blocklist #6542

Conversation

Sheraff commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai bot commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nx-cloud bot commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new bot commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Sheraff Jan 29, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Sheraff commented Jan 28, 2026 •

edited

Loading

coderabbitai bot commented Jan 28, 2026 •

edited

Loading

nx-cloud bot commented Jan 28, 2026 •

edited

Loading

pkg-pr-new bot commented Jan 28, 2026 •

edited

Loading