fix: guard base_expression and origin against data:/about: protocols in iframes

[okxint]

SvelteKit apps embedded in <iframe srcdoc> or <iframe src="data:..."> crash on hydration with a TypeError: Invalid URL because new URL(base, location) throws when location.protocol is data: or about:.

There is a secondary issue: location.origin returns the literal string "null" for data: URLs, which breaks any origin comparison.

A maintainer explicitly invited a fix in the issue thread.

Changes:

packages/kit/src/runtime/server/page/render.js

• Lines 125 and 132: wrap both new URL(…, location) expressions with a protocol guard. Falls back to '' (same as the server-side default) when running under data: or about:.

packages/kit/src/runtime/client/utils.js

• Line 4: guard the origin constant against non-http(s) protocols so it stays '' instead of the string "null".

Normal http:/https: behaviour is completely unchanged.

Fixes #13226

[pkg-svelte-dev]

Install the latest version of @sveltejs/kit from e17b78b:

pnpm add https://pkg.svelte.dev/@sveltejs/kit/c/e17b78b3d09c4c7cc85ed01751dec82de8ee7fb0

Open in pkg.svelte.dev: https://pkg.svelte.dev/repos/kit/pr/16516

Note

This PR is from a fork. A maintainer must approve approve each commit before it can be built and installed.

[changeset-bot]

🦋 Changeset detected

Latest commit: e17b78b

The changes in this PR will be included in the next version bump.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR