dvSafeInternalPath function

String dvSafeInternalPath(
  1. String? value
)

A path inside this application, or / when value could leave it.

The one rule for a from parameter: absolute URLs, a protocol-relative //host, a backslash, and anything unparseable all become the home page rather than somewhere a person did not mean to go.

Implementation

String dvSafeInternalPath(String? value) {
  if (value == null || value.isEmpty) return '/';
  if (!value.startsWith('/') || value.startsWith('//') || value.contains(r'\')) {
    return '/';
  }
  final Uri? uri = Uri.tryParse(value);
  if (uri == null || uri.hasScheme || uri.hasAuthority) return '/';
  return value;
}