A cross-origin url cannot be redirected to if "externalLinkTarget" is set to "_self" and "routerMode" is set to "history"

[ustc-zzzz]

Bug Report

Steps to reproduce

Set the options firstly:

window['$docsify'] = {
 routerMode: 'history',
 externalLinkTarget: '_self'
}

Then write a link whose url is from another domain:

Example: [example.com](https://example.com/)

What is current behaviour

If our domain were docsify.now.sh, it would do nothing and pop an error on the debug console:

Uncaught DOMException: Failed to execute 'pushState' on 'History': A history state object with URL 'https://example.com/' cannot be created in a document with origin 'https://docsify.now.sh' and URL 'https://docsify.now.sh/'.
 at https://unpkg.com/docsify@4.10.2/lib/docsify.min.js:1:61459

The corresponding source code is here.

What is the expected behaviour

Redirect to https://example.com/ normally.

Other relevant information

• Bug does still occur when all/other plugins are disabled?

• Your OS: Linux ZZZ-PC-4 5.4.0-4-amd64 #1 SMP Debian 5.4.19-1 (2020-02-13) x86_64 GNU/Linux

• Node.js version: v12.14.0

• npm/yarn version: 6.13.4

• Browser version: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 Safari/537.36

• Docsify version: 4.10.2

• Docsify plugins: None

[ustc-zzzz]

Also available on Firefox Browser (Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0):

SecurityError: The operation is insecure. docsify.min.js:formatted:1
 onchange docsify.min.js:2341

[Koooooo-7]

excuse me.
I can't reproduce ur bug.
can u give me a simple demo plz.

FYR:

Docsify version : 4.10.2
OS: windows10
Browser: Chrome. 
Settings as u posted above

[ustc-zzzz]

@Koooooo-7 Sorry. I forgot to report that routerMode should be set to history.
I have made a demo which is available on https://ustc-zzzz.github.io/docsify-issue-1046-demo/.

[Koooooo-7]

thx a lot.
I checked it and there is a same-origin policy issue about the history.pushState() .
this documentation mentions something about the url param.

The new URL must be of the same origin as the current URL; otherwise, pushState() will throw an exception.

@anikethsaha
tbh, I m not sure if there is a bug or security thing.
I plan to have a simple link checking before the history.pushState(),html5.js.
if the urls were cross-origin, I just use window.open(url,'_self') instead.
what's ur oppion?

[anikethsaha]

Thanks @Koooooo-7 for triaging this ! 💯

I am not so into security things that's why I can't give 100% opinion.
But as per the docs you mentioned, it seems pretty reasonable behavior of having same origin !

if the urls were cross-origin, I just use window.open(url,'_self') instead.

What do you think about having a separate option for this ?

[Koooooo-7]

@anikethsaha
normally, there would have the non cross origin URLs and the cross origin, so I think it is better that there have a sign (but I don't wanna make the URL congratulations messy) to mark the cross origin url, thus we don't need the URL checking.
I don't have some good idea about the seperate option right now.
could u show me some details about the seperate options.

[anikethsaha]

by option, I meant separate option for window.open(url,'_self') like if the option is true then we would check the url and use window.open(url,'_self') if required for opening.
else it would be the same operation like the present one !

[anikethsaha]

History mode by default shows the origin issue, so bypassing (doing the workaround to show the page) by default won't be a good idea .
its kind of the web standard behavior. But still, we can have some way to tackle this !

What do you think ?

[Koooooo-7]

@anikethsaha

by option, I meant separate option for window.open(url,'_self') like if the option is true then we would check the url and use window.open(url,'_self') if required for opening.

yep, where do u wanna set the option? As an independent configuration or the configuration with the URL?

else it would be the same operation like the present one !

yep, we do keep the present one.

As a independent option, it seems like this:

if ( optionFlag&& isCrossOriginUrl (url)){
 windows. open(url, '_self')
}
windows. history. pushState(... )

and, how about setting a sign/flag with the URL? only if we find the flag, we use windows. open instead of checking all the URLs.
such as

Example: [example.com](https://example.com/ ':crossurl=true')

[anikethsaha]

Example: [example.com](https://example.com/ ':crossurl=true')

this is much better. Lets do this one