Skip to content

bug: sanitizeHref() rejects valid same-directory relative paths (assets/x.svg → #) #381

@jorge-sader

Description

@jorge-sader

Bug found while integrating devify.me. assets/.../utils/url.js sanitizeHref() rejects valid same-directory relative paths: "assets/x.svg""#". It only accepts values starting with /, ., #, or http(s). This silently broke a header <img src> (rendered src="#").

Fix: accept a bare relative path segment (e.g. assets/x.svg, foo/bar.png), not only /.#/http prefixes — while still blocking javascript: and other dangerous schemes. Add a unit test for the bare-relative case.

Workaround in devify-me: pass ./assets/... (leading ./ passes the sanitizer). Surfaced 2026-06-20.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingdecision/draftDecision: initial statepriority:highHigh priority — work first within bundle

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions