fix: use invalid domain as base in toURL

[sapphi-red]

I don't think it's possible to actually exploit this. But it's still better to avoid a real domain here.

I didn't reject a URL without the base part as I guess this function need to accept path-only URLs (e.g. /foo).

fixes #31

[Ryderpro]

Thanks for opening a PR!

You are probably right!
A user under very specific conditions might be sending network traffic/proxying to dummy.org which is a real domain.
Is it being exploited currently? I very well doubt it.

But I'm seeing some cases where someone might proxy on accident to dummy.org as it currently exists with a light github search. And its for sale! 🙂
https://www.afternic.com/forsale/dummy.org

Some examples...
https://github.com/jo4rchy/Battlefield-Chinese-ID/blob/09398a845fa81bad6b4c581e262ca63a2f11d65f/frontend/vite.config.js#L6
https://github.com/nabildzr/terminal-site-web/blob/b490a0f1526b77062700f7e60b367c306bed2c0a/vite.config.example.js#L8
https://github.com/Geohot-2020/Vue.js_setup/blob/d1811a28fa52aced692de861b37b8fb11b12b41d/vue-crash-2024/.history/vite.config_20241112155224.js#L12
https://github.com/Nithya03sk/create-email/blob/48ef2b5912e157d2a8db262bc1d1f03bdd217d6b/vite.config.js#L6
https://github.com/ChatGPTProjectTeam/TripAdvisor/blob/c7ce9a9f5272516dcd86fb96ead1707731bd65cb/frontend/vite.config.js#L5

[williamstein]

Nice -- I totally agree.