`push` on the history object returned by `createBrowserHistory` can allow arbitrary JS execution

Hey folks!

If the input given to push is not sanitized, arbitrary JS can be executed in the user's context. We came across this issue originally in @reach/router but the same seems to exist in this package.

The iOS 100 pushState calls limit fix is what causes this. The browser correctly throws when the url given to pushState or replaceState contains javascript: which is caught by this catch clause causing window.location.assign to be used to update the url. This call isn't safe with unsanitized input and causes execution of JS.

But why not sanitize your input you might ask? Sure. We missed a spot and have fixed it on our end. Nevertheless, the push behaviour here circumvents the browser's security system and hence this report.

Codesandbox with the reproduction