navigate can leak into other domains

[kotx]

Using something like navigate("//google.com") the router will navigate to //google.com. (Pretty much any URL will work)

Is this intentional? If so, what's the recommended way to sanitize inputs?

[kotx]

Even navigate("javascript:alert(1)") will work which doesn't seem intended.