first commit

test/e2e/app-dir/javascript-urls/app/app/action-redirect-form/page.tsx

@@ -0,0 +1,23 @@
+import { redirect } from 'next/navigation'
+
+import { DANGEROUS_JAVASCRIPT_URL } from '../../../bad-url'
+
+async function handleRedirect() {
+  'use server'
+  redirect(DANGEROUS_JAVASCRIPT_URL)
+}
+
+export default function Page() {
+  return (
+    <>
+      <p>
+        Clicking this button should result in an error where Next.js blocks a
+        javascript URL through a server action redirect initiated by an onClick
+        handler
+      </p>
+      <form action={handleRedirect}>
+        <button type="submit">redirect via form action</button>
+      </form>
+    </>
+  )
+}

test/e2e/app-dir/javascript-urls/app/app/action-redirect-onclick/page.tsx

@@ -0,0 +1,21 @@
+import { redirect } from 'next/navigation'
+
+import { DANGEROUS_JAVASCRIPT_URL } from '../../../bad-url'
+
+async function handleRedirect() {
+  'use server'
+  redirect(DANGEROUS_JAVASCRIPT_URL)
+}
+
+export default function Page() {
+  return (
+    <>
+      <p>
+        Clicking this button should result in an error where Next.js blocks a
+        javascript URL through a server action redirect initiated by an onClick
+        handler
+      </p>
+      <button onClick={handleRedirect}>redirect via onclick action</button>
+    </>
+  )
+}

test/e2e/app-dir/javascript-urls/app/app/link-as/page.tsx

@@ -0,0 +1,18 @@
+import Link from 'next/link'
+
+import { DANGEROUS_JAVASCRIPT_URL } from '../../../bad-url'
+
+export default function Page() {
+  return (
+    <>
+      <p>
+        Clicking this link should result in an error where React blocks a
+        javascript URL
+      </p>
+      {/* In App Router as supercedes href but functionally it acts just like an href */}
+      <Link href="/" as={DANGEROUS_JAVASCRIPT_URL}>
+        Link with javascript URL `as`
+      </Link>
+    </>
+  )
+}

test/e2e/app-dir/javascript-urls/app/app/link-href/page.tsx

@@ -0,0 +1,17 @@
+import Link from 'next/link'
+
+import { DANGEROUS_JAVASCRIPT_URL } from '../../../bad-url'
+
+export default function Page() {
+  return (
+    <>
+      <p>
+        Clicking this link should result in an error where React blocks a
+        javascript URL
+      </p>
+      <Link href={DANGEROUS_JAVASCRIPT_URL}>
+        Link with javascript URL `href`
+      </Link>
+    </>
+  )
+}

test/e2e/app-dir/javascript-urls/app/app/router-prefetch/page.tsx

@@ -0,0 +1,20 @@
+'use client'
+
+import { useRouter } from 'next/navigation'
+
+import { DANGEROUS_JAVASCRIPT_URL } from '../../../bad-url'
+
+export default function Page() {
+  const router = useRouter()
+  return (
+    <>
+      <p>
+        Clicking this button should result in an error where Next.js blocks a
+        javascript URL
+      </p>
+      <button onClick={() => router.prefetch(DANGEROUS_JAVASCRIPT_URL)}>
+        prefetch javascript URL
+      </button>
+    </>
+  )
+}

test/e2e/app-dir/javascript-urls/app/app/router-push/page.tsx

@@ -0,0 +1,20 @@
+'use client'
+
+import { useRouter } from 'next/navigation'
+
+import { DANGEROUS_JAVASCRIPT_URL } from '../../../bad-url'
+
+export default function Page() {
+  const router = useRouter()
+  return (
+    <>
+      <p>
+        Clicking this button should result in an error where Next.js blocks a
+        javascript URL
+      </p>
+      <button onClick={() => router.push(DANGEROUS_JAVASCRIPT_URL)}>
+        push javascript URL
+      </button>
+    </>
+  )
+}

test/e2e/app-dir/javascript-urls/app/app/router-replace/page.tsx

@@ -0,0 +1,20 @@
+'use client'
+
+import { useRouter } from 'next/navigation'
+
+import { DANGEROUS_JAVASCRIPT_URL } from '../../../bad-url'
+
+export default function Page() {
+  const router = useRouter()
+  return (
+    <>
+      <p>
+        Clicking this button should result in an error where Next.js blocks a
+        javascript URL
+      </p>
+      <button onClick={() => router.replace(DANGEROUS_JAVASCRIPT_URL)}>
+        replace javascript URL
+      </button>
+    </>
+  )
+}

test/e2e/app-dir/javascript-urls/app/app/safe/page.tsx

@@ -0,0 +1,10 @@
+export default function Page() {
+  return (
+    <>
+      <p id="canarv">
+        This page is used as a navigation target to ensure SPA navigation
+        continues to work after pushing/redirecting/linking to a javascript URL.
+      </p>
+    </>
+  )
+}

test/e2e/app-dir/javascript-urls/app/boom/page.tsx

@@ -0,0 +1,10 @@
+export default function Page() {
+  return (
+    <>
+      <p id="pwned">
+        If you were redirected here then the dangerous javascript URL was
+        followed.
+      </p>
+    </>
+  )
+}

test/e2e/app-dir/javascript-urls/app/layout.tsx

@@ -0,0 +1,12 @@
+import Link from 'next/link'
+
+export default function Root({ children }: { children: React.ReactNode }) {
+  return (
+    <html>
+      <body>
+        <main>{children}</main>
+        <Link href="/app/safe">Safe Page</Link>
+      </body>
+    </html>
+  )
+}