fix: skip non-http(s) links in anchor click handler

[aashish00021]

Fixes #382

Problem

handleAnchor decides whether to intercept an <a> click for client-side routing via the same-origin check (url.origin === window.location.origin). But blob: URLs inherit the page origin — new URL("blob:https://example.com/abc").origin === "https://example.com" — so they pass that check and get routed to a garbage pathname instead of being left for the browser to handle.

Other non-http(s) schemes (mailto:, tel:, data:, javascript:, file:, ws:/wss:) have origin null or a non-matching origin, so the existing origin check already rejects them — only blob: slips through.

Fix

Guard against any non-http(s) scheme before the origin check:

const url = svg ? new URL(href, document.baseURI) : new URL(href);
if (url.protocol !== "https:" && url.protocol !== "http:") return;

blob: links are now skipped (previously routed); every other scheme is unchanged. A general non-http(s) guard is preferred over blob:-only — same size, but correct for any scheme that inherits the page origin (e.g. ws:/wss:).

Test

Adds a regression test using a no-base-path router (the scenario where a blob: link shares the page origin and slips past both the origin and path-prefix checks). Verified it fails without the guard (preventDefault is called → the blob gets routed) and passes with it.

• Full suite: 260 passing
• tsc typecheck: clean
• Prettier: clean
• Changeset: @solidjs/router patch

[changeset-bot]

🦋 Changeset detected

Latest commit: aa738bc

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@solidjs/router	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR