fix(prerender): filter encoded links starting with # (#1936)

unjs · Nov 20, 2023 · 088fa34 · 088fa34
1 parent cb7900c
commit 088fa34
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/src/prerender.ts b/src/prerender.ts
@@ -384,6 +384,7 @@ function extractLinks(
     _links.push(
       ...[...html.matchAll(LINK_REGEX)]
         .map((m) => escapeHtml(m[1]))
+        .filter((m) => !decodeURIComponent(m).startsWith("#"))
         .filter((link) => allowedExtensions.has(getExtension(link)))
     );
   }

diff --git a/test/fixture/routes/prerender.ts b/test/fixture/routes/prerender.ts
@@ -39,6 +39,8 @@ ${links.map((link) => `    <li><a href="${link}">${link}</a></li>`).join("\n")}
   <link rel="icon" href="data:image/png;base64,aaa//bbbbbb/ccc">
   <a x-href="/500?x-href">x-href attr</a>
   &lt;a href=&quot;/500&lt;/a&gt;
+  <a href='#a'>#a</a>
+  <a href='%23b'>#b</a>
 </body>
 </html>`;
 });