ref(nextjs): Change url of parser base to make security scanners less sus (getsentry#14695)

Luca Forstner · web-flow · commit c32e1a446531 · 2024-12-13T11:00:16.000+01:00
diff --git a/packages/nextjs/src/client/routing/appRouterRoutingInstrumentation.ts b/packages/nextjs/src/client/routing/appRouterRoutingInstrumentation.ts
@@ -129,7 +129,8 @@ export function appRouterInstrumentNavigation(client: Client): void {
 
 function transactionNameifyRouterArgument(target: string): string {
   try {
-    return new URL(target, 'http://some-random-base.com/').pathname;
+    // We provide an arbitrary base because we only care about the pathname and it makes URL parsing more resilient.
+    return new URL(target, 'http://example.com/').pathname;
   } catch {
     return '/';
   }

Original file line number	Diff line number	Diff line change
`@@ -129,7 +129,8 @@ export function appRouterInstrumentNavigation(client: Client): void {`
`129`	`129`
`130`	`130`	`function transactionNameifyRouterArgument(target: string): string {`
`131`	`131`	`try {`
`132`		`- return new URL(target, 'http://some-random-base.com/').pathname;`
	`132`	`+ // We provide an arbitrary base because we only care about the pathname and it makes URL parsing more resilient.`
	`133`	`+ return new URL(target, 'http://example.com/').pathname;`
`133`	`134`	`} catch {`
`134`	`135`	`return '/';`
`135`	`136`	`}`