I am currently working on a Vue application that was created using Vue-cli.
Vue version: 2.6.11
vue-router version: 3.2.0
Link for Reproduction
https://github.com/keyhangholami/dom-based-open-redirect
Instructions to replicate
To reproduce the issue, add 3 or more forward slashes in the URL followed by any random URL and a date formatted with slashes (e.g. ) and then press Enter.
Expected outcome
I would expect to see the 404 page when the URL is invalid (contains 3 or more slashes and a date).
Actual behavior
However, what actually happens is that the app redirects me to Google (or any other specified URL) along with all query parameters, even though I have not set any redirect rules. I do have the following route set up to redirect to a 404 page:
{ path: '*', name: '404-page', component: Page404, props: false }