Improved absolute redirect url detection in actions/loaders (#9829)

Author: lkwr

contributors.yml

@@ -96,6 +96,7 @@
 - latin-1
 - lequangdongg
 - liuhanqu
+- lkwr
 - lopezac
 - lordofthecactus
 - loun4

packages/router/__tests__/router-test.ts

@@ -11363,6 +11363,8 @@ describe("a router", () => {
           "https://remix.run/blog",
           "//remix.run/blog",
           "app://whatever",
+          "mailto:[email protected]",
+          "web+remix:whatever",
         ];
 
         for (let url of urls) {

packages/router/router.ts

@@ -2832,8 +2832,7 @@ async function callLoaderOrAction(
         "Redirects returned/thrown from loaders/actions must have a Location header"
       );
 
-      let isAbsolute =
-        /^[a-z+]+:\/\//i.test(location) || location.startsWith("//");
+      let isAbsolute = /^(?:[a-z][a-z0-9+.-]*:|\/\/)/i.test(location);
 
       // Support relative routing in internal redirects
       if (!isAbsolute) {