Fail gracefully on invalid Link to values (#10367)

Author: brophdawg11

.changeset/invalid-link-to.md

@@ -0,0 +1,5 @@
+---
+"react-router-dom": patch
+---
+
+Fail gracefully on `<Link to="//">` and other invalid URL values

packages/react-router-dom/__tests__/link-href-test.tsx

@@ -907,4 +907,24 @@ describe("<Link> href", () => {
       );
     });
   });
+
+  test("fails gracefully on invalid `to` values", () => {
+    let warnSpy = jest.spyOn(console, "warn").mockImplementation(() => {});
+    let renderer: TestRenderer.ReactTestRenderer;
+    TestRenderer.act(() => {
+      renderer = TestRenderer.create(
+        <MemoryRouter>
+          <Routes>
+            <Route path="/" element={<Link to="//" />} />
+          </Routes>
+        </MemoryRouter>
+      );
+    });
+
+    expect(renderer.root.findByType("a").props.href).toEqual("//");
+    expect(warnSpy).toHaveBeenCalledWith(
+      '<Link to="//"> contains an invalid URL which will probably break when clicked - please update to a valid URL path.'
+    );
+    warnSpy.mockRestore();
+  });
 });

packages/react-router-dom/index.tsx

@@ -451,17 +451,26 @@ export const Link = React.forwardRef<HTMLAnchorElement, LinkProps>(
 
       // Only check for external origins client-side
       if (isBrowser) {
-        let currentUrl = new URL(window.location.href);
-        let targetUrl = to.startsWith("//")
-          ? new URL(currentUrl.protocol + to)
-          : new URL(to);
-        let path = stripBasename(targetUrl.pathname, basename);
-
-        if (targetUrl.origin === currentUrl.origin && path != null) {
-          // Strip the protocol/origin/basename for same-origin absolute URLs
-          to = path + targetUrl.search + targetUrl.hash;
-        } else {
-          isExternal = true;
+        try {
+          let currentUrl = new URL(window.location.href);
+          let targetUrl = to.startsWith("//")
+            ? new URL(currentUrl.protocol + to)
+            : new URL(to);
+          let path = stripBasename(targetUrl.pathname, basename);
+
+          if (targetUrl.origin === currentUrl.origin && path != null) {
+            // Strip the protocol/origin/basename for same-origin absolute URLs
+            to = path + targetUrl.search + targetUrl.hash;
+          } else {
+            isExternal = true;
+          }
+        } catch (e) {
+          // We can't do external URL detection without a valid URL
+          warning(
+            false,
+            `<Link to="${to}"> contains an invalid URL which will probably break ` +
+              `when clicked - please update to a valid URL path.`
+          );
         }
       }
     }