fix: handle about: and data: protocols when embedded in iframes/webviews

.changeset/fix-non-hierarchical-protocol.md

@@ -0,0 +1,5 @@
+---
+'@sveltejs/kit': patch
+---
+
+fix: handle `about:` and `data:` protocols when embedded in iframes or webviews

packages/kit/src/runtime/client/utils.js

@@ -313,6 +313,12 @@ export function create_updated_store() {
  * @param {boolean} hash_routing
  */
 export function is_external_url(url, base, hash_routing) {
+	// about: and data: are non-hierarchical protocols used in embedded webviews
+	// and iframes with srcdoc — treat them as internal so navigation works
+	if (url.protocol === 'about:' || url.protocol === 'data:') {
+		return false;
+	}
+
 	if (url.origin !== origin || !url.pathname.startsWith(base)) {
 		return true;
 	}

packages/kit/src/runtime/server/page/render.js

@@ -119,14 +119,18 @@ export async function render_response({
 			base = segments.map(() => '..').join('/') || '.';
 
 			// resolve e.g. '../..' against current location, then remove trailing slash
-			base_expression = `new URL(${s(base)}, location).pathname.slice(0, -1)`;
+			// the try/catch handles non-hierarchical protocols like about: and data:
+			// (e.g. when embedded in <iframe srcdoc> or data: URLs)
+			base_expression = `(() => { try { return new URL(${s(base)}, location).pathname.slice(0, -1) } catch { return ${s(paths.base || '')} } })()`;
 
 			if (!paths.assets || (paths.assets[0] === '/' && paths.assets !== SVELTE_KIT_ASSETS)) {
 				assets = base;
 			}
 		} else if (options.hash_routing) {
 			// we have to assume that we're in the right place
-			base_expression = "new URL('.', location).pathname.slice(0, -1)";
+			// the try/catch handles non-hierarchical protocols like about: and data:
+			base_expression =
+				"(() => { try { return new URL('.', location).pathname.slice(0, -1) } catch { return '' } })()";
 		}
 	}