Function resolveUrl

packages/platform-server/src/url.ts:49–115

(
  urlStr: string | undefined,
  origin?: string | URL,
  options: ResolveUrlOptions = {},
)

  options?: ResolveUrlOptions,
): URL;
export function resolveUrl(
  urlStr: string | undefined,
  origin?: string | URL,
  options: ResolveUrlOptions = {},
): URL | null {
  const originUrl = typeof origin === 'string' ? new URL('/', origin) : origin;

  if (!urlStr) {
    return originUrl || null;
  }

  urlStr = urlStr.trim();

  // Fast-path: if the URL is a valid, standard absolute URL, parse and return it immediately.
  let resolved: URL | undefined;
  try {
    resolved = new URL(urlStr);
  } catch {}
  const {allowProtocolRelative = false, allowOriginChange = true} = options;

  if (resolved) {
    if (originUrl && !isSafeOriginChange(resolved, originUrl, urlStr, allowOriginChange)) {
      throwSuspiciousUrlError(urlStr);
    }

    return resolved;
  }

  // We identify and throw on malformed absolute URLs (like double port).
  // Per the WHATWG URL standard, parsing an input starting with a scheme (like 'http:') against
  // a standard base (like 'http://fake') ignores the base argument and parses strictly as an
  // absolute URL. Since it is malformed, the native URL constructor will throw a validation
  // error. Standard relative/protocol-relative paths parse successfully, allowing the flow to continue.
  if (!URL.canParse(urlStr, 'http://fake')) {
    throw new RuntimeError(
      RuntimeErrorCode.INVALID_URL,
      typeof ngDevMode === 'undefined' || ngDevMode ? `Invalid URL: ${urlStr}` : urlStr,
    );
  }

  if (!originUrl) {
    return null;
  }

  // Check if we have a legitimate protocol-relative URL (starts with '//' and not a duplicate/backslash bypass)
  // and we are configured to allow and preserve standard cross-origin protocol-relative requests.
  if (urlStr.startsWith('//')) {
    if (!allowProtocolRelative) {
      throw new RuntimeError(
        RuntimeErrorCode.PROTOCOL_RELATIVE_URL_NOT_ALLOWED,
        typeof ngDevMode === 'undefined' || ngDevMode
          ? `Protocol relative URLs are not allowed in this context. URL: ${urlStr}`
          : urlStr,
      );
    }

    return new URL(urlStr, origin);
  }