Fix/v4 open redirect CVE 2025 68470 v2

modules/LocationUtils.js

@@ -1,5 +1,6 @@
 import resolvePathname from 'resolve-pathname';
 import valueEqual from 'value-equal';
+import warning from './warning.js';
 
 import { parsePath } from './PathUtils.js';
 
@@ -47,6 +48,20 @@ export function createLocation(path, state, key, currentLocation) {
     }
   }
 
+  // Security fix: Normalize embedded double-slashes to prevent open redirect vulnerability (CVE-2025-68470)
+  // Paths like "//evil.com" could be interpreted as protocol-relative URLs leading to external redirects
+  if (location.pathname && location.pathname.includes('//')) {
+    const oldPathname = location.pathname;
+    location.pathname = location.pathname.replace(/\/\/+/g, '/');
+    warning(
+      false,
+      'Pathnames cannot have embedded double slashes - normalizing ' +
+        oldPathname +
+        ' -> ' +
+        location.pathname
+    );
+  }
+
   if (key) location.key = key;
 
   if (currentLocation) {

modules/__tests__/createLocation-test.js

@@ -141,4 +141,108 @@ describe('createLocation', () => {
       expect(Object.keys(location)).not.toContain('key');
     });
   });
+
+  describe('with embedded double-slashes (security fix for CVE-2025-68470)', () => {
+    describe('given as a string', () => {
+      it('normalizes double slashes at the start to prevent open redirect', () => {
+        expect(createLocation('//evil.com/path')).toMatchObject({
+          pathname: '/evil.com/path',
+          search: '',
+          hash: ''
+        });
+      });
+
+      it('normalizes double slashes in the middle of the path', () => {
+        expect(createLocation('/the//path')).toMatchObject({
+          pathname: '/the/path',
+          search: '',
+          hash: ''
+        });
+      });
+
+      it('normalizes multiple consecutive slashes', () => {
+        expect(createLocation('///the////path///segment')).toMatchObject({
+          pathname: '/the/path/segment',
+          search: '',
+          hash: ''
+        });
+      });
+
+      it('normalizes double slashes while preserving search and hash', () => {
+        expect(createLocation('//evil.com/path?query=value#hash')).toMatchObject({
+          pathname: '/evil.com/path',
+          search: '?query=value',
+          hash: '#hash'
+        });
+      });
+
+      it('handles protocol-relative URLs that could redirect externally', () => {
+        expect(createLocation('//attacker.com')).toMatchObject({
+          pathname: '/attacker.com',
+          search: '',
+          hash: ''
+        });
+      });
+    });
+
+    describe('given as an object', () => {
+      it('normalizes double slashes at the start to prevent open redirect', () => {
+        expect(
+          createLocation({
+            pathname: '//evil.com/path',
+            search: '?the=query',
+            hash: '#the-hash'
+          })
+        ).toMatchObject({
+          pathname: '/evil.com/path',
+          search: '?the=query',
+          hash: '#the-hash'
+        });
+      });
+
+      it('normalizes double slashes in the middle of the path', () => {
+        expect(
+          createLocation({
+            pathname: '/the//path',
+            search: '?the=query',
+            hash: '#the-hash'
+          })
+        ).toMatchObject({
+          pathname: '/the/path',
+          search: '?the=query',
+          hash: '#the-hash'
+        });
+      });
+
+      it('normalizes multiple consecutive slashes', () => {
+        expect(
+          createLocation({
+            pathname: '///the////path'
+          })
+        ).toMatchObject({
+          pathname: '/the/path',
+          search: '',
+          hash: ''
+        });
+      });
+    });
+
+    describe('paths without double slashes', () => {
+      it('does not modify normal paths', () => {
+        expect(createLocation('/normal/path')).toMatchObject({
+          pathname: '/normal/path',
+          search: '',
+          hash: ''
+        });
+      });
+
+      it('does not modify paths with single slashes', () => {
+        expect(createLocation('/path/to/resource')).toMatchObject({
+          pathname: '/path/to/resource',
+          search: '',
+          hash: ''
+        });
+      });
+    });
+  });
 });

package.json

@@ -1,6 +1,6 @@
 {
   "name": "history",
-  "version": "4.10.1",
+  "version": "4.10.2",
   "description": "Manage session history with JavaScript",
   "repository": "ReactTraining/history",
   "license": "MIT",