can-route-pushstate - npm Package Compare versions

Comparing version 3.2.4 to 3.4.0

can-route-pushstate_test.js

@@ -908,2 +908,78 @@ /* jshint asi:true,scripturl:true */
 
+		test("javascript: void(0) links get pushstated", function(){
+			stop();
+			makeTestingIframe(function (info, done) {
+				info.route(":type", { type: "yay" });
+				info.route.ready();
+
+
+				var window = info.window;
+				var link = window.document.createElement("a");
+				link.href = "javascript: void(0)";
+				link.innerHTML = "Click Me";
+
+				window.document.body.appendChild(link);
+				try {
+					domDispatch.call(link, "click");
+					ok(true, "Clicking javascript: void(0) anchor did not cause a security exception");
+				} catch(err) {
+					ok(false, "Clicking javascript: void(0) anchor caused a security exception");
+				}
+
+				start();
+				done();
+			});
+		});
+
+		test("links with target=_blank do not get pushstated", function(){
+			stop();
+			makeTestingIframe(function (info, done) {
+				info.route(":type", { type: "yay" });
+				info.route.ready();
+
+
+				var window = info.window;
+				var link = window.document.createElement("a");
+				link.href = "/yay";
+				link.target = "_blank";
+				link.innerHTML = "Click Me";
+
+				window.document.body.appendChild(link);
+				try {
+					domDispatch.call(link, "click");
+					ok(true, "Clicking anchor with blank target did not cause a security exception");
+				} catch(err) {
+					ok(false, "Clicking anchor with blank target caused a security exception");
+				}
+
+				start();
+				done();
+			});
+		});
+
+		test("clicking on links while holding meta key do not get pushstated", function(){
+			stop();
+			makeTestingIframe(function (info, done) {
+				info.route(":type", { type: "yay" });
+				info.route.ready();
+
+
+				var window = info.window;
+				var link = window.document.createElement("a");
+				link.href = "/heyo";
+				link.innerHTML = "Click Me";
+
+				window.document.body.appendChild(link);
+				try {
+					domDispatch.call(link, {type: 'click', metaKey: true});
+					ok(true, "Clicking anchor with blank target did not cause a security exception");
+				} catch(err) {
+					ok(false, "Clicking anchor with blank target caused a security exception");
+				}
+
+				start();
+				done();
+			});
+		});
+
 	} // end steal-only
@@ -910,0 +986,0 @@

can-route-pushstate.js

@@ -180,2 +180,12 @@ // # can/route/pushstate/pushstate.js
 
+			// Do not pushstate if target is for blank window.
+			if (node.target === "_blank") {
+				return;
+			}
+
+			// Do not pushstate if meta key was pressed, mimicking standard browser behavior.
+			if (event.altKey || event.ctrlKey || event.metaKey || event.shiftKey) {
+				return;
+			}
+
 			// If link is within the same domain and descendant of `root`
@@ -182,0 +192,0 @@ if (window.location.host === linksHost) {

dist/amd/can-route-pushstate.js

@@ -1,2 +0,2 @@
-/*can-route-pushstate@3.2.3#can-route-pushstate*/
+/*can-route-pushstate@3.3.0#can-route-pushstate*/
 define([
@@ -105,2 +105,8 @@ 'require',
                         }
+                        if (node.target === '_blank') {
+                            return;
+                        }
+                        if (event.altKey || event.ctrlKey || event.metaKey || event.shiftKey) {
+                            return;
+                        }
                         if (window.location.host === linksHost) {
@@ -107,0 +113,0 @@ var root = cleanRoot();

package.json

 {
   "name": "can-route-pushstate",
-  "version": "3.2.4",
+  "version": "3.4.0",
   "description": "Pushstate for can-route",
@@ -5,0 +5,0 @@ "homepage": "https://canjs.com",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Deprecated

Maintenance

The maintainer of the package marked it as deprecated. This could indicate that a single version should not be used, or that the package is no longer maintained and any new vulnerabilities will not be fixed.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

285486

increased by3.68%

Lines of code

7229

increased by4.51%

Worsened metrics

Number of medium maintenance alerts

1

increased byInfinity%

No dependency changes