fix(platform-server): enforce allowOriginChange for protocol-relative urls

resolveUrl routes every return path through the origin-change safety check
except the protocol-relative branch, which returns the resolved URL directly.
A caller passing {allowProtocolRelative: true, allowOriginChange: false} could
then resolve a //host input to a different origin, ignoring the
allowOriginChange: false it asked for. Re-check the resolved origin in that
branch so the option is honored consistently.

Author: arshsmith1

packages/platform-server/src/url.ts

@@ -102,7 +102,16 @@ export function resolveUrl(
       );
     }
 
-    return new URL(urlStr, origin);
+    resolved = new URL(urlStr, origin);
+
+    // A protocol-relative URL inherits the base scheme, so the only origin-sensitive
+    // change it can introduce is the host. Honor `allowOriginChange` here too, the same
+    // way every other return path does.
+    if (!allowOriginChange && resolved.origin !== originUrl.origin) {
+      throwSuspiciousUrlError(urlStr);
+    }
+
+    return resolved;
   }
 
   resolved = new URL(urlStr, origin);

packages/platform-server/test/url_spec.ts

@@ -48,6 +48,30 @@ describe('resolveUrl', () => {
       expect(url.href).toBe('http://test.com/other-path');
     });
 
+    it('should throw for a protocol-relative url that changes origin when allowOriginChange is false', () => {
+      expect(() =>
+        resolveUrl('//evil.com/path', 'http://test.com', {
+          allowProtocolRelative: true,
+          allowOriginChange: false,
+        }),
+      ).toThrowError(/NG05703/);
+    });
+
+    it('should resolve a same-origin protocol-relative url when allowOriginChange is false', () => {
+      const url = resolveUrl('//test.com/other-path', 'http://test.com', {
+        allowProtocolRelative: true,
+        allowOriginChange: false,
+      });
+      expect(url.href).toBe('http://test.com/other-path');
+    });
+
+    it('should resolve a cross-origin protocol-relative url when origin changes are allowed', () => {
+      const url = resolveUrl('//other.com/path', 'http://test.com', {
+        allowProtocolRelative: true,
+      });
+      expect(url.origin).toBe('http://other.com');
+    });
+
     it('should throw an error for malformed absolute URLs', () => {
       const malformedUrls = [
         'http://evil.com:80:80/path',