@@ -41,19 +41,31 @@ define([
41
41
urlParseRE : / ^ \s * ( ( ( ( [ ^ : \/ # \? ] + : ) ? (?: ( \/ \/ ) ( (?: ( ( [ ^ : @ \/ # \? ] + ) (?: \: ( [ ^ : @ \/ # \? ] + ) ) ? ) @ ) ? ( ( [ ^ : \/ # \? \] \[ ] + | \[ [ ^ \/ \] @ # ? ] + \] ) (?: \: ( [ 0 - 9 ] + ) ) ? ) ) ? ) ? ) ? ( ( \/ ? (?: [ ^ \/ \? # ] + \/ + ) * ) ( [ ^ \? # ] * ) ) ) ? ( \? [ ^ # ] + ) ? ) ( # .* ) ? / ,
42
42
43
43
// Abstraction to address xss (Issue #4787) by removing the authority in
44
- // browsers that auto decode it. All references to location.href should be
44
+ // browsers that auto- decode it. All references to location.href should be
45
45
// replaced with a call to this method so that it can be dealt with properly here
46
46
getLocation : function ( url ) {
47
- var uri = url ? this . parseUrl ( url ) : location ,
48
- hash = this . parseUrl ( url || location . href ) . hash ;
47
+
48
+ // Always use our own URL parser, even though location potentially provides all the
49
+ // fields we may need later on. This way, URL parsing is consistent, and we only
50
+ // grab location.href from the browser.
51
+ var uri = this . parseUrl ( url || location . href ) ,
52
+ hash = uri . hash ;
49
53
50
54
// mimic the browser with an empty string when the hash is empty
51
55
hash = hash === "#" ? "" : hash ;
52
56
57
+ // The pathname must start with a slash if there's a protocol, because you can't
58
+ // have a protocol followed by a relative path. Also, it's impossible to calculate
59
+ // absolute URLs from relative ones if the absolute one doesn't have a leading "/".
60
+ if ( uri . protocol !== "" && uri . pathname . substring ( 0 , 1 ) !== "/" ) {
61
+ uri . pathname = "/" + uri . pathname ;
62
+ uri . directory = "/" + uri . directory ;
63
+ }
64
+
53
65
// Make sure to parse the url or the location object for the hash because using location.hash
54
66
// is autodecoded in firefox, the rest of the url should be from the object (location unless
55
67
// we're testing) to avoid the inclusion of the authority
56
- return uri . protocol + "//" + uri . host + uri . pathname + uri . search + hash ;
68
+ return uri . protocol + uri . doubleSlash + uri . host + uri . pathname + uri . search + hash ;
57
69
} ,
58
70
59
71
//return the original document url
@@ -323,7 +335,7 @@ define([
323
335
324
336
// reconstruct each of the pieces with the new search string and hash
325
337
href = path . parseUrl ( href ) ;
326
- href = href . protocol + "//" + href . host + href . pathname + search + preservedHash ;
338
+ href = href . protocol + href . doubleSlash + href . host + href . pathname + search + preservedHash ;
327
339
} else {
328
340
href += href . indexOf ( "#" ) > - 1 ? uiState : "#" + uiState ;
329
341
}
0 commit comments