return false on error and no origin provided

Author: Rohit3523

app/lib/methods/helpers/isSameOrigin.test.ts

@@ -19,6 +19,6 @@ describe('isSameOrigin', () => {
 	});
 
 	test('returns true when origin is undefined', () => {
-		expect(isSameOrigin('https://releases.rocket.chat/x')).toBe(true);
+		expect(isSameOrigin('https://releases.rocket.chat/x')).toBe(false);
 	});
 });

app/lib/methods/helpers/isSameOrigin.ts

@@ -1,11 +1,10 @@
 export const isSameOrigin = (url: string, origin?: string): boolean => {
 	if (!origin) {
-		return true;
+		return false;
 	}
 	try {
-		return new URL(url).origin === new URL(origin).origin;
+		return new URL(url, origin).origin === new URL(origin).origin;
 	} catch {
-		// Relative/internal URL — safe to attach auth headers.
-		return true;
+		return false;
 	}
 };