From af84da066add6daf843410bf0540a5620ac10b2b Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Thu, 13 May 2021 20:50:33 +0200 Subject: [PATCH 01/48] [test] Fix multiple mixed slashes test Refs: https://github.com/unshiftio/url-parse/pull/197#discussion_r577898939 --- test/test.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/test.js b/test/test.js index 216891e..eec3937 100644 --- a/test/test.js +++ b/test/test.js @@ -291,7 +291,7 @@ describe('url-parse', function () { assume(parsed.hostname).equals('github.com'); assume(parsed.pathname).equals('/foo/bar'); - url = 'https:/\/\/\github.com/foo/bar'; + url = 'https:/\\/\\/\\github.com/foo/bar'; assume(parsed.host).equals('github.com'); assume(parsed.hostname).equals('github.com'); assume(parsed.pathname).equals('/foo/bar'); From 9f43f43de91febafeb8c04985f494691c9925610 Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Sat, 15 May 2021 08:59:05 +0200 Subject: [PATCH 02/48] [pkg] Update browserify to version 17.0.0 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index f84b62e..ae11801 100644 --- a/package.json +++ b/package.json @@ -38,7 +38,7 @@ }, "devDependencies": { "assume": "^2.2.0", - "browserify": "^16.2.3", + "browserify": "^17.0.0", "c8": "^7.3.1", "coveralls": "^3.1.0", "mocha": "^8.0.1", From d2979b586d8c7751e0c77f127d9ce1b2143cc0c9 Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Tue, 18 May 2021 07:00:54 +0200 Subject: [PATCH 03/48] [fix] Special case the `file:` protocol (#204) Fixes #203 --- index.js | 13 +++++++++---- test/test.js | 42 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 51 insertions(+), 4 deletions(-) diff --git a/index.js b/index.js index 72b27c0..94e357e 100644 --- a/index.js +++ b/index.js @@ -33,7 +33,7 @@ var rules = [ ['#', 'hash'], // Extract from the back. ['?', 'query'], // Extract from the back. function sanitize(address) { // Sanitize what is left of the address - return address.replace('\\', '/'); + return address.replace(/\\/g, '/'); }, ['/', 'pathname'], // Extract from the back. ['@', 'auth', 1], // Extract from the front. @@ -224,7 +224,9 @@ function Url(address, location, parser) { // When the authority component is absent the URL starts with a path // component. // - if (!extracted.slashes) instructions[3] = [/(.*)/, 'pathname']; + if (!extracted.slashes || url.protocol === 'file:') { + instructions[3] = [/(.*)/, 'pathname']; + } for (; i < instructions.length; i++) { instruction = instructions[i]; @@ -288,7 +290,10 @@ function Url(address, location, parser) { // Default to a / for pathname if none exists. This normalizes the URL // to always have a / // - if (url.pathname.charAt(0) !== '/' && url.hostname) { + if ( + url.pathname.charAt(0) !== '/' + && (url.hostname || url.protocol === 'file:') + ) { url.pathname = '/' + url.pathname; } @@ -430,7 +435,7 @@ function toString(stringify) { if (protocol && protocol.charAt(protocol.length - 1) !== ':') protocol += ':'; - var result = protocol + (url.slashes ? '//' : ''); + var result = protocol + (url.slashes || url.protocol === 'file:' ? '//' : ''); if (url.username) { result += url.username; diff --git a/test/test.js b/test/test.js index eec3937..38290ed 100644 --- a/test/test.js +++ b/test/test.js @@ -438,6 +438,48 @@ describe('url-parse', function () { data.set('protocol', 'https:'); assume(data.href).equals('https://google.com/foo'); }); + + it('handles the file: protocol', function () { + var slashes = ['', '/', '//', '///', '////', '/////']; + var data; + var url; + + for (var i = 0; i < slashes.length; i++) { + data = parse('file:' + slashes[i]); + assume(data.protocol).equals('file:'); + assume(data.pathname).equals('/'); + assume(data.href).equals('file:///'); + } + + url = 'file:///Users/foo/BAR/baz.pdf'; + data = parse(url); + assume(data.protocol).equals('file:'); + assume(data.pathname).equals('/Users/foo/BAR/baz.pdf'); + assume(data.href).equals(url); + + url = 'file:///foo/bar?baz=qux#hash'; + data = parse(url); + assume(data.protocol).equals('file:'); + assume(data.hash).equals('#hash'); + assume(data.query).equals('?baz=qux'); + assume(data.pathname).equals('/foo/bar'); + assume(data.href).equals(url); + + data = parse('file://c:\\foo\\bar\\'); + assume(data.protocol).equals('file:'); + assume(data.pathname).equals('/c:/foo/bar/'); + assume(data.href).equals('file:///c:/foo/bar/'); + + data = parse('foo/bar', 'file:///baz'); + assume(data.protocol).equals('file:'); + assume(data.pathname).equals('/foo/bar'); + assume(data.href).equals('file:///foo/bar'); + + data = parse('foo/bar', 'file:///baz/'); + assume(data.protocol).equals('file:'); + assume(data.pathname).equals('/baz/foo/bar'); + assume(data.href).equals('file:///baz/foo/bar'); + }); }); describe('ip', function () { From ee22050a48a67409aa5f7c87947284156d615bd1 Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Thu, 3 Jun 2021 12:14:05 +0200 Subject: [PATCH 04/48] [ci] Use GitHub Actions --- .github/workflows/ci.yml | 38 ++++++++++++++++++++++++++++++++++++++ .travis.yml | 25 ------------------------- README.md | 2 +- package.json | 3 +-- test/browser.js | 2 +- 5 files changed, 41 insertions(+), 29 deletions(-) create mode 100644 .github/workflows/ci.yml delete mode 100644 .travis.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..945a447 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,38 @@ +name: CI + +on: + - push + - pull_request + +jobs: + test: + runs-on: ubuntu-latest + strategy: + matrix: + node: + - 12 + - 14 + - 16 + steps: + - uses: actions/checkout@v2 + - uses: actions/setup-node@v2 + with: + node-version: ${{ matrix.node }} + - run: npm install + - run: npm test + - uses: coverallsapp/github-action@v1.1.2 + if: matrix.node == 12 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + test-browser: + runs-on: ubuntu-latest + env: + SAUCE_USERNAME: url-parse + SAUCE_ACCESS_KEY: ${{ secrets.SAUCE_ACCESS_KEY }} + steps: + - uses: actions/checkout@v2 + - uses: actions/setup-node@v2 + with: + node-version: 12 + - run: npm install + - run: npm run test-browser diff --git a/.travis.yml b/.travis.yml deleted file mode 100644 index 7333c3e..0000000 --- a/.travis.yml +++ /dev/null @@ -1,25 +0,0 @@ -language: node_js -matrix: - fast_finish: true - include: - - node_js: "14" - env: SCRIPT=test - - node_js: "12" - env: SCRIPT=test - - node_js: "10" - env: SCRIPT=test - - node_js: "12" - env: - - secure: IF01oyIKSs0C5dARdYRTilKnU1TG4zenjjEPClkQxAWIpUOxl9xcNJWDVEOPxJ/4pVt+pozyT80Rp7efh6ZiREJIQI1tUboBKSqZzSbnD5uViQNSbQ90PaDP0FIUc0IQ5o07W36rijBB0DTmtU1VofzN9PKkJO7XiSSXevI8RcM= - - SAUCE_USERNAME=url-parse - - SCRIPT=test-browser -script: - - "npm run ${SCRIPT}" -after_script: - - 'if [ "${SCRIPT}" == "test" ]; then c8 report --reporter=text-lcov | coveralls; fi' -notifications: - irc: - channels: - - "irc.freenode.org#unshift" - on_success: change - on_failure: change diff --git a/README.md b/README.md index f81f919..4540e4b 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # url-parse -[![Made by unshift](https://img.shields.io/badge/made%20by-unshift-00ffcc.svg?style=flat-square)](http://unshift.io)[![Version npm](https://img.shields.io/npm/v/url-parse.svg?style=flat-square)](https://www.npmjs.com/package/url-parse)[![Build Status](https://img.shields.io/travis/unshiftio/url-parse/master.svg?style=flat-square)](https://travis-ci.org/unshiftio/url-parse)[![Dependencies](https://img.shields.io/david/unshiftio/url-parse.svg?style=flat-square)](https://david-dm.org/unshiftio/url-parse)[![Coverage Status](https://img.shields.io/coveralls/unshiftio/url-parse/master.svg?style=flat-square)](https://coveralls.io/r/unshiftio/url-parse?branch=master)[![IRC channel](https://img.shields.io/badge/IRC-irc.freenode.net%23unshift-00a8ff.svg?style=flat-square)](https://webchat.freenode.net/?channels=unshift) +[![Made by unshift](https://img.shields.io/badge/made%20by-unshift-00ffcc.svg?style=flat-square)](http://unshift.io)[![Version npm](https://img.shields.io/npm/v/url-parse.svg?style=flat-square)](https://www.npmjs.com/package/url-parse)[![Build Status](https://img.shields.io/github/workflow/status/unshiftio/url-parse/CI/master?label=CI&style=flat-square)](https://github.com/unshiftio/url-parse/actions?query=workflow%3ACI+branch%3Amaster)[![Dependencies](https://img.shields.io/david/unshiftio/url-parse.svg?style=flat-square)](https://david-dm.org/unshiftio/url-parse)[![Coverage Status](https://img.shields.io/coveralls/unshiftio/url-parse/master.svg?style=flat-square)](https://coveralls.io/r/unshiftio/url-parse?branch=master)[![IRC channel](https://img.shields.io/badge/IRC-irc.freenode.net%23unshift-00a8ff.svg?style=flat-square)](https://webchat.freenode.net/?channels=unshift) [![Sauce Test Status](https://saucelabs.com/browser-matrix/url-parse.svg)](https://saucelabs.com/u/url-parse) diff --git a/package.json b/package.json index ae11801..93a6797 100644 --- a/package.json +++ b/package.json @@ -6,7 +6,7 @@ "scripts": { "browserify": "rm -rf dist && mkdir -p dist && browserify index.js -s URLParse -o dist/url-parse.js", "minify": "uglifyjs dist/url-parse.js --source-map -cm -o dist/url-parse.min.js", - "test": "c8 --reporter=html --reporter=text mocha test/test.js", + "test": "c8 --reporter=lcov --reporter=text mocha test/test.js", "test-browser": "node test/browser.js", "prepublishOnly": "npm run browserify && npm run minify", "watch": "mocha --watch test/test.js" @@ -40,7 +40,6 @@ "assume": "^2.2.0", "browserify": "^17.0.0", "c8": "^7.3.1", - "coveralls": "^3.1.0", "mocha": "^8.0.1", "pre-commit": "^1.2.2", "sauce-browsers": "^2.0.0", diff --git a/test/browser.js b/test/browser.js index 200ec5e..63ee99b 100644 --- a/test/browser.js +++ b/test/browser.js @@ -29,12 +29,12 @@ const platforms = sauceBrowsers([ }); run(path.join(__dirname, 'test.js'), 'saucelabs', { + jobInfo: { name: pkg.name, build: process.env.GITHUB_RUN_ID }, html: path.join(__dirname, 'index.html'), accessKey: process.env.SAUCE_ACCESS_KEY, username: process.env.SAUCE_USERNAME, browserify: true, disableSSL: true, - name: pkg.name, parallel: 5, platforms }).done((results) => { From 81ab967889b08112d3356e451bf03e6aa0cbb7e0 Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Fri, 23 Jul 2021 18:31:42 +0200 Subject: [PATCH 05/48] [fix] Ignore slashes after the protocol for special URLs Fixes #205 Fixes #206 --- index.js | 51 ++++++++++++++++++++++++++++++++++------ test/test.js | 66 +++++++++++++++++++++++++++++++++++++++++++++++++--- 2 files changed, 107 insertions(+), 10 deletions(-) diff --git a/index.js b/index.js index 94e357e..f424acc 100644 --- a/index.js +++ b/index.js @@ -98,6 +98,24 @@ function lolcation(loc) { return finaldestination; } +/** + * Check whether a protocol scheme is special. + * + * @param {String} The protocol scheme of the URL + * @return {Boolean} `true` if the protocol scheme is special, else `false` + * @private + */ +function isSpecial(scheme) { + return ( + scheme === 'file:' || + scheme === 'ftp:' || + scheme === 'http:' || + scheme === 'https:' || + scheme === 'ws:' || + scheme === 'wss:' + ); +} + /** * @typedef ProtocolExtract * @type Object @@ -110,16 +128,32 @@ function lolcation(loc) { * Extract protocol information from a URL with/without double slash ("//"). * * @param {String} address URL we want to extract from. + * @param {Object} location * @return {ProtocolExtract} Extracted information. * @private */ -function extractProtocol(address) { +function extractProtocol(address, location) { address = trimLeft(address); + location = location || {}; - var match = protocolre.exec(address) - , protocol = match[1] ? match[1].toLowerCase() : '' - , slashes = !!(match[2] && match[2].length >= 2) - , rest = match[2] && match[2].length === 1 ? '/' + match[3] : match[3]; + var match = protocolre.exec(address); + var protocol = match[1] ? match[1].toLowerCase() : ''; + var rest = match[2] ? match[2] + match[3] : match[3]; + var slashes = !!(match[2] && match[2].length >= 2); + + if (protocol === 'file:') { + if (slashes) { + rest = rest.slice(2); + } + } else if (isSpecial(protocol)) { + rest = match[3]; + } else if (protocol) { + if (rest.indexOf('//') === 0) { + rest = rest.slice(2); + } + } else if (slashes && location.hostname) { + rest = match[3]; + } return { protocol: protocol, @@ -214,7 +248,7 @@ function Url(address, location, parser) { // // Extract protocol information before running the instructions. // - extracted = extractProtocol(address || ''); + extracted = extractProtocol(address || '', location); relative = !extracted.protocol && !extracted.slashes; url.slashes = extracted.slashes || relative && location.slashes; url.protocol = extracted.protocol || location.protocol || ''; @@ -224,7 +258,10 @@ function Url(address, location, parser) { // When the authority component is absent the URL starts with a path // component. // - if (!extracted.slashes || url.protocol === 'file:') { + if ( + url.protocol === 'file:' || + (!extracted.slashes && !isSpecial(extracted.protocol)) + ) { instructions[3] = [/(.*)/, 'pathname']; } diff --git a/test/test.js b/test/test.js index 38290ed..9a84fba 100644 --- a/test/test.js +++ b/test/test.js @@ -93,7 +93,7 @@ describe('url-parse', function () { assume(parse.extractProtocol('//foo/bar')).eql({ slashes: true, protocol: '', - rest: 'foo/bar' + rest: '//foo/bar' }); }); @@ -283,7 +283,7 @@ describe('url-parse', function () { assume(parsed.href).equals('http://what-is-up.com/'); }); - it('does not see a slash after the protocol as path', function () { + it('ignores slashes after the protocol for special URLs', function () { var url = 'https:\\/github.com/foo/bar' , parsed = parse(url); @@ -292,11 +292,59 @@ describe('url-parse', function () { assume(parsed.pathname).equals('/foo/bar'); url = 'https:/\\/\\/\\github.com/foo/bar'; + parsed = parse(url); assume(parsed.host).equals('github.com'); assume(parsed.hostname).equals('github.com'); assume(parsed.pathname).equals('/foo/bar'); + + url = 'https:/github.com/foo/bar'; + parsed = parse(url); + assume(parsed.host).equals('github.com'); + assume(parsed.pathname).equals('/foo/bar'); + + url = 'https:\\github.com/foo/bar'; + parsed = parse(url); + assume(parsed.host).equals('github.com'); + assume(parsed.pathname).equals('/foo/bar'); + + url = 'https:github.com/foo/bar'; + parsed = parse(url); + assume(parsed.host).equals('github.com'); + assume(parsed.pathname).equals('/foo/bar'); + + url = 'https:github.com/foo/bar'; + parsed = parse(url); + assume(parsed.host).equals('github.com'); + assume(parsed.pathname).equals('/foo/bar'); }); + it('handles slashes after the protocol for non special URLs', function () { + var url = 'foo:example.com' + , parsed = parse(url); + + assume(parsed.hostname).equals(''); + assume(parsed.pathname).equals('example.com'); + assume(parsed.href).equals('foo:example.com'); + + url = 'foo:/example.com'; + parsed = parse(url); + assume(parsed.hostname).equals(''); + assume(parsed.pathname).equals('/example.com'); + assume(parsed.href).equals('foo:/example.com'); + + url = 'foo://example.com'; + parsed = parse(url); + assume(parsed.hostname).equals('example.com'); + assume(parsed.pathname).equals('/'); + assume(parsed.href).equals('foo://example.com/'); + + url = 'foo:///example.com'; + parsed = parse(url); + assume(parsed.hostname).equals(''); + assume(parsed.pathname).equals('/example.com'); + assume(parsed.href).equals('foo:///example.com'); + }) + describe('origin', function () { it('generates an origin property', function () { var url = 'http://google.com:80/pathname' @@ -440,7 +488,7 @@ describe('url-parse', function () { }); it('handles the file: protocol', function () { - var slashes = ['', '/', '//', '///', '////', '/////']; + var slashes = ['', '/', '//', '///']; var data; var url; @@ -451,6 +499,18 @@ describe('url-parse', function () { assume(data.href).equals('file:///'); } + url = 'file:////'; + data = parse(url); + assume(data.protocol).equals('file:'); + assume(data.pathname).equals('//'); + assume(data.href).equals(url); + + url = 'file://///'; + data = parse(url); + assume(data.protocol).equals('file:'); + assume(data.pathname).equals('///'); + assume(data.href).equals(url); + url = 'file:///Users/foo/BAR/baz.pdf'; data = parse(url); assume(data.protocol).equals('file:'); From 94872e7ab9103ee69b958959baa14c9e682a7f10 Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Sat, 24 Jul 2021 09:27:05 +0200 Subject: [PATCH 06/48] [fix] Do not incorrectly set the `slashes` property to `true` Set it to `true` only if the protocol is special or if it is actually followed by two forward slashes. --- index.js | 44 ++++++++++++++++++++++++++++++++------------ test/test.js | 40 ++++++++++++++++++++++++++++++++++------ 2 files changed, 66 insertions(+), 18 deletions(-) diff --git a/index.js b/index.js index f424acc..73b53f6 100644 --- a/index.js +++ b/index.js @@ -2,8 +2,8 @@ var required = require('requires-port') , qs = require('querystringify') - , slashes = /^[A-Za-z][A-Za-z0-9+-.]*:[\\/]+/ - , protocolre = /^([a-z][a-z0-9.+-]*:)?([\\/]{1,})?([\S\s]*)/i + , slashes = /^[A-Za-z][A-Za-z0-9+-.]*:\/\// + , protocolre = /^([a-z][a-z0-9.+-]*:)?(\/\/)?([\\/]+)?([\S\s]*)/i , whitespace = '[\\x09\\x0A\\x0B\\x0C\\x0D\\x20\\xA0\\u1680\\u180E\\u2000\\u2001\\u2002\\u2003\\u2004\\u2005\\u2006\\u2007\\u2008\\u2009\\u200A\\u202F\\u205F\\u3000\\u2028\\u2029\\uFEFF]' , left = new RegExp('^'+ whitespace +'+'); @@ -138,26 +138,46 @@ function extractProtocol(address, location) { var match = protocolre.exec(address); var protocol = match[1] ? match[1].toLowerCase() : ''; - var rest = match[2] ? match[2] + match[3] : match[3]; - var slashes = !!(match[2] && match[2].length >= 2); + var forwardSlashes = !!match[2]; + var otherSlashes = !!match[3]; + var slashesCount = 0; + var rest; + + if (forwardSlashes) { + if (otherSlashes) { + rest = match[2] + match[3] + match[4]; + slashesCount = match[2].length + match[3].length; + } else { + rest = match[2] + match[4]; + slashesCount = match[2].length; + } + } else { + if (otherSlashes) { + rest = match[3] + match[4]; + slashesCount = match[3].length; + } else { + rest = match[4] + } + } if (protocol === 'file:') { - if (slashes) { + if (slashesCount >= 2) { rest = rest.slice(2); } } else if (isSpecial(protocol)) { - rest = match[3]; + rest = match[4]; } else if (protocol) { - if (rest.indexOf('//') === 0) { + if (forwardSlashes) { rest = rest.slice(2); } - } else if (slashes && location.hostname) { - rest = match[3]; + } else if (slashesCount >= 2 && location.hostname) { + rest = match[4]; } return { protocol: protocol, - slashes: slashes, + slashes: forwardSlashes || isSpecial(protocol), + slashesCount: slashesCount, rest: rest }; } @@ -260,7 +280,7 @@ function Url(address, location, parser) { // if ( url.protocol === 'file:' || - (!extracted.slashes && !isSpecial(extracted.protocol)) + (extracted.slashesCount < 2 && !isSpecial(extracted.protocol)) ) { instructions[3] = [/(.*)/, 'pathname']; } @@ -472,7 +492,7 @@ function toString(stringify) { if (protocol && protocol.charAt(protocol.length - 1) !== ':') protocol += ':'; - var result = protocol + (url.slashes || url.protocol === 'file:' ? '//' : ''); + var result = protocol + (url.slashes || isSpecial(url.protocol) ? '//' : ''); if (url.username) { result += url.username; diff --git a/test/test.js b/test/test.js index 9a84fba..71cc473 100644 --- a/test/test.js +++ b/test/test.js @@ -71,7 +71,8 @@ describe('url-parse', function () { assume(parse.extractProtocol('http://example.com')).eql({ slashes: true, protocol: 'http:', - rest: 'example.com' + rest: 'example.com', + slashesCount: 2 }); }); @@ -79,7 +80,8 @@ describe('url-parse', function () { assume(parse.extractProtocol('')).eql({ slashes: false, protocol: '', - rest: '' + rest: '', + slashesCount: 0 }); }); @@ -87,13 +89,15 @@ describe('url-parse', function () { assume(parse.extractProtocol('/foo')).eql({ slashes: false, protocol: '', - rest: '/foo' + rest: '/foo', + slashesCount: 1 }); assume(parse.extractProtocol('//foo/bar')).eql({ slashes: true, protocol: '', - rest: '//foo/bar' + rest: '//foo/bar', + slashesCount: 2 }); }); @@ -103,7 +107,8 @@ describe('url-parse', function () { assume(parse.extractProtocol(input)).eql({ slashes: false, protocol: '', - rest: input + rest: input, + slashesCount: 0 }); }); @@ -111,7 +116,8 @@ describe('url-parse', function () { assume(parse.extractProtocol(' javascript://foo')).eql({ slashes: true, protocol: 'javascript:', - rest: 'foo' + rest: 'foo', + slashesCount: 2 }); }); }); @@ -281,6 +287,12 @@ describe('url-parse', function () { assume(parsed.host).equals('what-is-up.com'); assume(parsed.href).equals('http://what-is-up.com/'); + + url = '\\\\\\\\what-is-up.com' + parsed = parse(url, parse('http://google.com')); + + assume(parsed.host).equals('what-is-up.com'); + assume(parsed.href).equals('http://what-is-up.com/'); }); it('ignores slashes after the protocol for special URLs', function () { @@ -290,32 +302,44 @@ describe('url-parse', function () { assume(parsed.host).equals('github.com'); assume(parsed.hostname).equals('github.com'); assume(parsed.pathname).equals('/foo/bar'); + assume(parsed.slashes).is.true(); + assume(parsed.href).equals('https://github.com/foo/bar'); url = 'https:/\\/\\/\\github.com/foo/bar'; parsed = parse(url); assume(parsed.host).equals('github.com'); assume(parsed.hostname).equals('github.com'); assume(parsed.pathname).equals('/foo/bar'); + assume(parsed.slashes).is.true(); + assume(parsed.href).equals('https://github.com/foo/bar'); url = 'https:/github.com/foo/bar'; parsed = parse(url); assume(parsed.host).equals('github.com'); assume(parsed.pathname).equals('/foo/bar'); + assume(parsed.slashes).is.true(); + assume(parsed.href).equals('https://github.com/foo/bar'); url = 'https:\\github.com/foo/bar'; parsed = parse(url); assume(parsed.host).equals('github.com'); assume(parsed.pathname).equals('/foo/bar'); + assume(parsed.slashes).is.true(); + assume(parsed.href).equals('https://github.com/foo/bar'); url = 'https:github.com/foo/bar'; parsed = parse(url); assume(parsed.host).equals('github.com'); assume(parsed.pathname).equals('/foo/bar'); + assume(parsed.slashes).is.true(); + assume(parsed.href).equals('https://github.com/foo/bar'); url = 'https:github.com/foo/bar'; parsed = parse(url); assume(parsed.host).equals('github.com'); assume(parsed.pathname).equals('/foo/bar'); + assume(parsed.slashes).is.true(); + assume(parsed.href).equals('https://github.com/foo/bar'); }); it('handles slashes after the protocol for non special URLs', function () { @@ -325,24 +349,28 @@ describe('url-parse', function () { assume(parsed.hostname).equals(''); assume(parsed.pathname).equals('example.com'); assume(parsed.href).equals('foo:example.com'); + assume(parsed.slashes).is.false(); url = 'foo:/example.com'; parsed = parse(url); assume(parsed.hostname).equals(''); assume(parsed.pathname).equals('/example.com'); assume(parsed.href).equals('foo:/example.com'); + assume(parsed.slashes).is.false(); url = 'foo://example.com'; parsed = parse(url); assume(parsed.hostname).equals('example.com'); assume(parsed.pathname).equals('/'); assume(parsed.href).equals('foo://example.com/'); + assume(parsed.slashes).is.true(); url = 'foo:///example.com'; parsed = parse(url); assume(parsed.hostname).equals(''); assume(parsed.pathname).equals('/example.com'); assume(parsed.href).equals('foo:///example.com'); + assume(parsed.slashes).is.true(); }) describe('origin', function () { From fed6d9e338ea39de2d68bb66607066d71328c62f Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Sat, 24 Jul 2021 09:35:58 +0200 Subject: [PATCH 07/48] [fix] Add a leading slash only if the URL is special If the value of the `pathname` property does not start with a `/`, add it only if the URL is special. --- index.js | 5 +---- test/test.js | 4 ++-- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/index.js b/index.js index 73b53f6..6f2299a 100644 --- a/index.js +++ b/index.js @@ -347,10 +347,7 @@ function Url(address, location, parser) { // Default to a / for pathname if none exists. This normalizes the URL // to always have a / // - if ( - url.pathname.charAt(0) !== '/' - && (url.hostname || url.protocol === 'file:') - ) { + if (url.pathname.charAt(0) !== '/' && isSpecial(url.protocol)) { url.pathname = '/' + url.pathname; } diff --git a/test/test.js b/test/test.js index 71cc473..fc240fc 100644 --- a/test/test.js +++ b/test/test.js @@ -361,8 +361,8 @@ describe('url-parse', function () { url = 'foo://example.com'; parsed = parse(url); assume(parsed.hostname).equals('example.com'); - assume(parsed.pathname).equals('/'); - assume(parsed.href).equals('foo://example.com/'); + assume(parsed.pathname).equals(''); + assume(parsed.href).equals('foo://example.com'); assume(parsed.slashes).is.true(); url = 'foo:///example.com'; From fb128af4f43fa17f351d50cf615c7598c751f50a Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Sat, 24 Jul 2021 18:19:10 +0200 Subject: [PATCH 08/48] [fix] Use `'null'` as `origin` for non special URLs --- index.js | 4 ++-- test/test.js | 7 +++++++ 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/index.js b/index.js index 6f2299a..8e31ae3 100644 --- a/index.js +++ b/index.js @@ -371,7 +371,7 @@ function Url(address, location, parser) { url.password = instruction[1] || ''; } - url.origin = url.protocol && url.host && url.protocol !== 'file:' + url.origin = url.protocol !== 'file:' && isSpecial(url.protocol) && url.host ? url.protocol +'//'+ url.host : 'null'; @@ -464,7 +464,7 @@ function set(part, value, fn) { if (ins[4]) url[ins[1]] = url[ins[1]].toLowerCase(); } - url.origin = url.protocol && url.host && url.protocol !== 'file:' + url.origin = url.protocol !== 'file:' && isSpecial(url.protocol) && url.host ? url.protocol +'//'+ url.host : 'null'; diff --git a/test/test.js b/test/test.js index fc240fc..d5a6cab 100644 --- a/test/test.js +++ b/test/test.js @@ -395,6 +395,13 @@ describe('url-parse', function () { assume(parsed.origin).equals('null'); }); + it('is null for non special URLs', function () { + var o = parse('foo://example.com/pathname'); + assume(o.hostname).equals('example.com'); + assume(o.pathname).equals('/pathname'); + assume(o.origin).equals('null'); + }); + it('removes default ports for http', function () { var o = parse('http://google.com:80/pathname'); assume(o.origin).equals('http://google.com'); From 2d9ac2c94067742b2116332c1e03be9f37371dff Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Sun, 25 Jul 2021 14:36:29 +0200 Subject: [PATCH 09/48] [fix] Sanitize only special URLs (#209) Fixes https://github.com/unshiftio/url-parse/pull/208#discussion_r675788224. --- index.js | 13 ++++++++----- test/test.js | 30 +++++++++++++++++++++++++++++- 2 files changed, 37 insertions(+), 6 deletions(-) diff --git a/index.js b/index.js index 8e31ae3..903fce2 100644 --- a/index.js +++ b/index.js @@ -32,8 +32,8 @@ function trimLeft(str) { var rules = [ ['#', 'hash'], // Extract from the back. ['?', 'query'], // Extract from the back. - function sanitize(address) { // Sanitize what is left of the address - return address.replace(/\\/g, '/'); + function sanitize(address, url) { // Sanitize what is left of the address + return isSpecial(url.protocol) ? address.replace(/\\/g, '/') : address; }, ['/', 'pathname'], // Extract from the back. ['@', 'auth', 1], // Extract from the front. @@ -170,7 +170,7 @@ function extractProtocol(address, location) { if (forwardSlashes) { rest = rest.slice(2); } - } else if (slashesCount >= 2 && location.hostname) { + } else if (slashesCount >= 2 && isSpecial(location.protocol)) { rest = match[4]; } @@ -280,7 +280,10 @@ function Url(address, location, parser) { // if ( url.protocol === 'file:' || - (extracted.slashesCount < 2 && !isSpecial(extracted.protocol)) + (!extracted.slashes && + (extracted.protocol || + extracted.slashesCount < 2 || + !isSpecial(url.protocol))) ) { instructions[3] = [/(.*)/, 'pathname']; } @@ -289,7 +292,7 @@ function Url(address, location, parser) { instruction = instructions[i]; if (typeof instruction === 'function') { - address = instruction(address); + address = instruction(address, url); continue; } diff --git a/test/test.js b/test/test.js index d5a6cab..1893891 100644 --- a/test/test.js +++ b/test/test.js @@ -358,6 +358,13 @@ describe('url-parse', function () { assume(parsed.href).equals('foo:/example.com'); assume(parsed.slashes).is.false(); + url = 'foo:\\example.com'; + parsed = parse(url); + assume(parsed.hostname).equals(''); + assume(parsed.pathname).equals('\\example.com'); + assume(parsed.href).equals('foo:\\example.com'); + assume(parsed.slashes).is.false(); + url = 'foo://example.com'; parsed = parse(url); assume(parsed.hostname).equals('example.com'); @@ -365,13 +372,34 @@ describe('url-parse', function () { assume(parsed.href).equals('foo://example.com'); assume(parsed.slashes).is.true(); + url = 'foo:\\\\example.com'; + parsed = parse(url); + assume(parsed.hostname).equals(''); + assume(parsed.pathname).equals('\\\\example.com'); + assume(parsed.href).equals('foo:\\\\example.com'); + assume(parsed.slashes).is.false(); + url = 'foo:///example.com'; parsed = parse(url); assume(parsed.hostname).equals(''); assume(parsed.pathname).equals('/example.com'); assume(parsed.href).equals('foo:///example.com'); assume(parsed.slashes).is.true(); - }) + + url = 'foo:\\\\\\example.com'; + parsed = parse(url); + assume(parsed.hostname).equals(''); + assume(parsed.pathname).equals('\\\\\\example.com'); + assume(parsed.href).equals('foo:\\\\\\example.com'); + assume(parsed.slashes).is.false(); + + url = '\\\\example.com/foo/bar'; + parsed = parse(url, 'foo://bar.com'); + assume(parsed.hostname).equals('bar.com'); + assume(parsed.pathname).equals('/\\\\example.com/foo/bar'); + assume(parsed.href).equals('foo://bar.com/\\\\example.com/foo/bar'); + assume(parsed.slashes).is.true(); + }); describe('origin', function () { it('generates an origin property', function () { From 201034b8670c2aa382d7ec410ee750ac6f2f9c38 Mon Sep 17 00:00:00 2001 From: Arnout Kazemier Date: Sun, 25 Jul 2021 14:43:14 +0200 Subject: [PATCH 10/48] [dist] 1.5.2 --- SECURITY.md | 15 +++++++++++++++ package.json | 2 +- 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 31ef5b4..3a97067 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -33,6 +33,19 @@ acknowledge your responsible disclosure, if you wish. ## History +> url-parse mishandles certain use a single of (back) slash such as https:\ & +> https:/ and > interprets the URI as a relative path. Browsers accept a single +> backslash after the protocol, and treat it as a normal slash, while url-parse +> sees it as a relative path. + +- **Reporter credits** + - Ready-Research + - GitHub: [@Ready-Reserach](https://github.com/ready-research) +- Huntr report: https://www.huntr.dev/bounties/1625557993985-unshiftio/url-parse/ +- Fixed in: 1.5.2 + +--- + > Using backslash in the protocol is valid in the browser, while url-parse > thinks it’s a relative path. An application that validates a url using > url-parse might pass a malicious link. @@ -42,6 +55,8 @@ acknowledge your responsible disclosure, if you wish. - Twitter: [Yaniv Nizry](https://twitter.com/ynizry) - Fixed in: 1.5.0 +--- + > The `extractProtocol` method does not return the correct protocol when > provided with unsanitized content which could lead to false positives. diff --git a/package.json b/package.json index 93a6797..3183f73 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "url-parse", - "version": "1.5.1", + "version": "1.5.2", "description": "Small footprint URL parser that works seamlessly across Node.js and browser environments", "main": "index.js", "scripts": { From c7984617e235892cc22e0f47bb5ff1c012e6e39f Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Mon, 26 Jul 2021 00:16:21 +0200 Subject: [PATCH 11/48] [fix] Fix host parsing for file URLs (#210) Fixes: https://github.com/unshiftio/url-parse/pull/209#issuecomment-886235848 --- index.js | 4 +++- test/test.js | 7 +++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/index.js b/index.js index 903fce2..c6052d5 100644 --- a/index.js +++ b/index.js @@ -4,6 +4,7 @@ var required = require('requires-port') , qs = require('querystringify') , slashes = /^[A-Za-z][A-Za-z0-9+-.]*:\/\// , protocolre = /^([a-z][a-z0-9.+-]*:)?(\/\/)?([\\/]+)?([\S\s]*)/i + , windowsDriveLetter = /^[a-zA-Z]:/ , whitespace = '[\\x09\\x0A\\x0B\\x0C\\x0D\\x20\\xA0\\u1680\\u180E\\u2000\\u2001\\u2002\\u2003\\u2004\\u2005\\u2006\\u2007\\u2008\\u2009\\u200A\\u202F\\u205F\\u3000\\u2028\\u2029\\uFEFF]' , left = new RegExp('^'+ whitespace +'+'); @@ -279,7 +280,8 @@ function Url(address, location, parser) { // component. // if ( - url.protocol === 'file:' || + extracted.protocol === 'file:' && ( + extracted.slashesCount !== 2 || windowsDriveLetter.test(address)) || (!extracted.slashes && (extracted.protocol || extracted.slashesCount < 2 || diff --git a/test/test.js b/test/test.js index 1893891..8b34f7a 100644 --- a/test/test.js +++ b/test/test.js @@ -593,6 +593,13 @@ describe('url-parse', function () { assume(data.pathname).equals('/c:/foo/bar/'); assume(data.href).equals('file:///c:/foo/bar/'); + data = parse('file://host/file'); + assume(data.protocol).equals('file:'); + assume(data.host).equals('host'); + assume(data.hostname).equals('host'); + assume(data.pathname).equals('/file'); + assume(data.href).equals('file://host/file'); + data = parse('foo/bar', 'file:///baz'); assume(data.protocol).equals('file:'); assume(data.pathname).equals('/foo/bar'); From ad444931666a30bad11472d89a216461cf16cae2 Mon Sep 17 00:00:00 2001 From: Arnout Kazemier Date: Mon, 26 Jul 2021 00:17:19 +0200 Subject: [PATCH 12/48] [dist] 1.5.3 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 3183f73..1364b9b 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "url-parse", - "version": "1.5.2", + "version": "1.5.3", "description": "Small footprint URL parser that works seamlessly across Node.js and browser environments", "main": "index.js", "scripts": { From 78f7017f4f4c9b364640bcb7de655cb838e83de9 Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Sun, 8 Aug 2021 07:56:35 +0200 Subject: [PATCH 13/48] [pkg] Update mocha to version 9.0.3 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 1364b9b..09ce54e 100644 --- a/package.json +++ b/package.json @@ -40,7 +40,7 @@ "assume": "^2.2.0", "browserify": "^17.0.0", "c8": "^7.3.1", - "mocha": "^8.0.1", + "mocha": "^9.0.3", "pre-commit": "^1.2.2", "sauce-browsers": "^2.0.0", "sauce-test": "^1.3.3", From d9e332b3cee790b6852152b707a4e39c00945f8c Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Sat, 14 Aug 2021 15:28:29 +0200 Subject: [PATCH 14/48] [fix] Do not add spurious slashes The forward slashes are not removed if there is no protocol so they must not be added back when the `Url` object is stringified. --- index.js | 4 +++- test/test.js | 7 +++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/index.js b/index.js index c6052d5..4c1a80e 100644 --- a/index.js +++ b/index.js @@ -494,7 +494,9 @@ function toString(stringify) { if (protocol && protocol.charAt(protocol.length - 1) !== ':') protocol += ':'; - var result = protocol + (url.slashes || isSpecial(url.protocol) ? '//' : ''); + var result = + protocol + + ((url.protocol && url.slashes) || isSpecial(url.protocol) ? '//' : ''); if (url.username) { result += url.username; diff --git a/test/test.js b/test/test.js index 8b34f7a..013596e 100644 --- a/test/test.js +++ b/test/test.js @@ -401,6 +401,13 @@ describe('url-parse', function () { assume(parsed.slashes).is.true(); }); + it('does not readd slashes to href if there is no protocol', function() { + var parsed = parse('//example.com', {}); + + assume(parsed.pathname).equals('//example.com'); + assume(parsed.href).equals('//example.com'); + }); + describe('origin', function () { it('generates an origin property', function () { var url = 'http://google.com:80/pathname' From 993acbe7b9e1da823271c9d33c573b3869c0cc79 Mon Sep 17 00:00:00 2001 From: bluelovers Date: Sat, 14 Aug 2021 22:45:21 +0800 Subject: [PATCH 15/48] [fix] Handle the `auth` property (#213) Update the value of the `username` and `password` properties when the `auth` property is set. Fixes #212 --- index.js | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/index.js b/index.js index 4c1a80e..95cd4fa 100644 --- a/index.js +++ b/index.js @@ -459,6 +459,13 @@ function set(part, value, fn) { } break; + case 'auth': + var splits = value.split(':'); + url.username = splits[0]; + url.password = splits.length === 2 ? splits[1] : ''; + url[part] = value; + break; + default: url[part] = value; } From 15b1dbde255886469a7a547fc0b96e9b2afc66f8 Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Sat, 14 Aug 2021 21:48:05 +0200 Subject: [PATCH 16/48] [fix] Do not lose the password in the stringification process Handle the case where the value of the `username` property is empty and the value of the `password` property is non-empty. --- index.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/index.js b/index.js index 95cd4fa..3dd673e 100644 --- a/index.js +++ b/index.js @@ -509,6 +509,9 @@ function toString(stringify) { result += url.username; if (url.password) result += ':'+ url.password; result += '@'; + } else if (url.password) { + result += ':'+ url.password; + result += '@'; } result += url.host + url.pathname; From 0be9572efadb092d47b49eb62ddee88aa9ee73fd Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Sat, 14 Aug 2021 22:22:17 +0200 Subject: [PATCH 17/48] [test] Test that `Url#set()` correctly handles the `auth` property Test that when the value of the `auth` property is updated, the values of the `username` and `password` properties are also updated. Refs: https://github.com/unshiftio/url-parse/pull/213 --- test/test.js | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/test/test.js b/test/test.js index 013596e..188e072 100644 --- a/test/test.js +++ b/test/test.js @@ -1046,6 +1046,30 @@ describe('url-parse', function () { assume(data.href).equals('mailto:alice@atlanta.com'); }); + it('updates username and password when updating auth', function() { + var data = parse('https://example.com'); + + assume(data.set('auth', 'foo:bar')).equals(data); + assume(data.username).equals('foo'); + assume(data.password).equals('bar'); + assume(data.href).equals('https://foo:bar@example.com/'); + + assume(data.set('auth', 'baz:')).equals(data); + assume(data.username).equals('baz'); + assume(data.password).equals(''); + assume(data.href).equals('https://baz@example.com/'); + + assume(data.set('auth', 'qux')).equals(data); + assume(data.username).equals('qux'); + assume(data.password).equals(''); + assume(data.href).equals('https://qux@example.com/'); + + assume(data.set('auth', ':quux')).equals(data); + assume(data.username).equals(''); + assume(data.password).equals('quux'); + assume(data.href).equals('https://:quux@example.com/'); + }); + it('updates other values', function () { var data = parse('http://google.com/?foo=bar'); From 53d4d6dfd1ec24f5747271c6f2e86ffa6959b22b Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Mon, 23 Aug 2021 10:02:37 +0200 Subject: [PATCH 18/48] [fix] Handle the `username` and `password` properties Update the value of the `auth` property when the `username` or `password` property is set. Refs: https://github.com/unshiftio/url-parse/pull/213#issuecomment-897373589 --- index.js | 11 +++++++---- test/test.js | 56 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 63 insertions(+), 4 deletions(-) diff --git a/index.js b/index.js index 3dd673e..ec936e0 100644 --- a/index.js +++ b/index.js @@ -459,15 +459,16 @@ function set(part, value, fn) { } break; + case 'username': + case 'password': + url[part] = encodeURIComponent(value); + break; + case 'auth': var splits = value.split(':'); url.username = splits[0]; url.password = splits.length === 2 ? splits[1] : ''; url[part] = value; - break; - - default: - url[part] = value; } for (var i = 0; i < rules.length; i++) { @@ -476,6 +477,8 @@ function set(part, value, fn) { if (ins[4]) url[ins[1]] = url[ins[1]].toLowerCase(); } + url.auth = url.password ? url.username +':'+ url.password : url.username; + url.origin = url.protocol !== 'file:' && isSpecial(url.protocol) && url.host ? url.protocol +'//'+ url.host : 'null'; diff --git a/test/test.js b/test/test.js index 188e072..8130081 100644 --- a/test/test.js +++ b/test/test.js @@ -1046,6 +1046,62 @@ describe('url-parse', function () { assume(data.href).equals('mailto:alice@atlanta.com'); }); + it('updates auth when updating username', function() { + var data = parse('https://example.com'); + + assume(data.set('username', 'foo')).equals(data); + assume(data.username).equals('foo'); + assume(data.auth).equals('foo') + assume(data.href).equals('https://foo@example.com/'); + + data.set('username', ''); + + assume(data.username).equals(''); + assume(data.auth).equals('') + assume(data.href).equals('https://example.com/'); + + data.set('username', 'foo:'); + + assume(data.username).equals('foo%3A'); + assume(data.auth).equals('foo%3A') + assume(data.href).equals('https://foo%3A@example.com/'); + + data = parse('https://foo:bar@example.com') + data.set('username', 'baz'); + + assume(data.username).equals('baz'); + assume(data.auth).equals('baz:bar') + assume(data.href).equals('https://baz:bar@example.com/'); + }); + + it('updates auth when updating password', function() { + var data = parse('https://example.com'); + + assume(data.set('password', 'foo')).equals(data); + assume(data.password).equals('foo'); + assume(data.auth).equals(':foo') + assume(data.href).equals('https://:foo@example.com/'); + + data.set('password', ''); + + assume(data.password).equals(''); + assume(data.auth).equals('') + assume(data.href).equals('https://example.com/'); + + data.set('password', ':foo@'); + + assume(data.password).equals('%3Afoo%40'); + assume(data.auth).equals(':%3Afoo%40') + assume(data.href).equals('https://:%3Afoo%40@example.com/'); + + data = parse('https://foo:bar@example.com') + data.set('password', 'baz'); + + assume(data.password).equals('baz'); + assume(data.auth).equals('foo:baz') + assume(data.href).equals('https://foo:baz@example.com/'); + }); + it('updates username and password when updating auth', function() { var data = parse('https://example.com'); From 5472388f816631c82f30c8507aae0cdea610128e Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Mon, 23 Aug 2021 10:31:28 +0200 Subject: [PATCH 19/48] [minor] Remove dead code --- index.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/index.js b/index.js index ec936e0..9f83367 100644 --- a/index.js +++ b/index.js @@ -372,7 +372,7 @@ function Url(address, location, parser) { url.username = url.password = ''; if (url.auth) { instruction = url.auth.split(':'); - url.username = instruction[0] || ''; + url.username = instruction[0]; url.password = instruction[1] || ''; } From 36dd8b4a9c38f35f27f7ba58612bc6e08928db61 Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Mon, 23 Aug 2021 18:44:59 +0200 Subject: [PATCH 20/48] [minor] Remove redundant assignment --- index.js | 1 - 1 file changed, 1 deletion(-) diff --git a/index.js b/index.js index 9f83367..702308b 100644 --- a/index.js +++ b/index.js @@ -468,7 +468,6 @@ function set(part, value, fn) { var splits = value.split(':'); url.username = splits[0]; url.password = splits.length === 2 ? splits[1] : ''; - url[part] = value; } for (var i = 0; i < rules.length; i++) { From e9a835370b554da970753b95baf78071f847247c Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Wed, 15 Sep 2021 21:18:38 +0200 Subject: [PATCH 21/48] [ci] Update coverallsapp/github-action action to version 1.1.3 --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 945a447..48b3df2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,7 +20,7 @@ jobs: node-version: ${{ matrix.node }} - run: npm install - run: npm test - - uses: coverallsapp/github-action@v1.1.2 + - uses: coverallsapp/github-action@1.1.3 if: matrix.node == 12 with: github-token: ${{ secrets.GITHUB_TOKEN }} From a72a5c6039d8a7b9087cca0249997f402775c00b Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Mon, 4 Oct 2021 20:58:18 +0200 Subject: [PATCH 22/48] [doc] Remove "made by" and IRC badges --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 4540e4b..30a81f0 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # url-parse -[![Made by unshift](https://img.shields.io/badge/made%20by-unshift-00ffcc.svg?style=flat-square)](http://unshift.io)[![Version npm](https://img.shields.io/npm/v/url-parse.svg?style=flat-square)](https://www.npmjs.com/package/url-parse)[![Build Status](https://img.shields.io/github/workflow/status/unshiftio/url-parse/CI/master?label=CI&style=flat-square)](https://github.com/unshiftio/url-parse/actions?query=workflow%3ACI+branch%3Amaster)[![Dependencies](https://img.shields.io/david/unshiftio/url-parse.svg?style=flat-square)](https://david-dm.org/unshiftio/url-parse)[![Coverage Status](https://img.shields.io/coveralls/unshiftio/url-parse/master.svg?style=flat-square)](https://coveralls.io/r/unshiftio/url-parse?branch=master)[![IRC channel](https://img.shields.io/badge/IRC-irc.freenode.net%23unshift-00a8ff.svg?style=flat-square)](https://webchat.freenode.net/?channels=unshift) +[![Version npm](https://img.shields.io/npm/v/url-parse.svg?style=flat-square)](https://www.npmjs.com/package/url-parse)[![Build Status](https://img.shields.io/github/workflow/status/unshiftio/url-parse/CI/master?label=CI&style=flat-square)](https://github.com/unshiftio/url-parse/actions?query=workflow%3ACI+branch%3Amaster)[![Dependencies](https://img.shields.io/david/unshiftio/url-parse.svg?style=flat-square)](https://david-dm.org/unshiftio/url-parse)[![Coverage Status](https://img.shields.io/coveralls/unshiftio/url-parse/master.svg?style=flat-square)](https://coveralls.io/r/unshiftio/url-parse?branch=master) [![Sauce Test Status](https://saucelabs.com/browser-matrix/url-parse.svg)](https://saucelabs.com/u/url-parse) From 5e8a444bd284e2658f88a7f05f004501c82ae0ac Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Thu, 28 Oct 2021 21:48:06 +0200 Subject: [PATCH 23/48] [ci] Test on node 17 --- .github/workflows/ci.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 48b3df2..f4711d4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,6 +13,7 @@ jobs: - 12 - 14 - 16 + - 17 steps: - uses: actions/checkout@v2 - uses: actions/setup-node@v2 From e3248744a3353fc5a105c0d8141c8bcb457d4092 Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Thu, 11 Nov 2021 21:03:07 +0100 Subject: [PATCH 24/48] [doc] Remove dependency status badge --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 30a81f0..94f08d1 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # url-parse -[![Version npm](https://img.shields.io/npm/v/url-parse.svg?style=flat-square)](https://www.npmjs.com/package/url-parse)[![Build Status](https://img.shields.io/github/workflow/status/unshiftio/url-parse/CI/master?label=CI&style=flat-square)](https://github.com/unshiftio/url-parse/actions?query=workflow%3ACI+branch%3Amaster)[![Dependencies](https://img.shields.io/david/unshiftio/url-parse.svg?style=flat-square)](https://david-dm.org/unshiftio/url-parse)[![Coverage Status](https://img.shields.io/coveralls/unshiftio/url-parse/master.svg?style=flat-square)](https://coveralls.io/r/unshiftio/url-parse?branch=master) +[![Version npm](https://img.shields.io/npm/v/url-parse.svg?style=flat-square)](https://www.npmjs.com/package/url-parse)[![Build Status](https://img.shields.io/github/workflow/status/unshiftio/url-parse/CI/master?label=CI&style=flat-square)](https://github.com/unshiftio/url-parse/actions?query=workflow%3ACI+branch%3Amaster)[![Coverage Status](https://img.shields.io/coveralls/unshiftio/url-parse/master.svg?style=flat-square)](https://coveralls.io/r/unshiftio/url-parse?branch=master) [![Sauce Test Status](https://saucelabs.com/browser-matrix/url-parse.svg)](https://saucelabs.com/u/url-parse) From 82c4908ab3ca12ea4f06e4b4779dd43957df6d53 Mon Sep 17 00:00:00 2001 From: Arnout Kazemier <3rd-Eden@users.noreply.github.com> Date: Tue, 28 Dec 2021 02:49:52 +0100 Subject: [PATCH 25/48] [dist] 1.5.4 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 09ce54e..b777acb 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "url-parse", - "version": "1.5.3", + "version": "1.5.4", "description": "Small footprint URL parser that works seamlessly across Node.js and browser environments", "main": "index.js", "scripts": { From f7774f608418b59a43ad1816c954654fdc8b1248 Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Sun, 9 Jan 2022 07:59:52 +0100 Subject: [PATCH 26/48] [security] Fix typos in SECURITY.md --- SECURITY.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 3a97067..f85d48f 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -33,8 +33,8 @@ acknowledge your responsible disclosure, if you wish. ## History -> url-parse mishandles certain use a single of (back) slash such as https:\ & -> https:/ and > interprets the URI as a relative path. Browsers accept a single +> url-parse mishandles certain uses of a single (back) slash such as https:\ & +> https:/ and interprets the URI as a relative path. Browsers accept a single > backslash after the protocol, and treat it as a normal slash, while url-parse > sees it as a relative path. From 9be7ee88afd2bb04e4d5a1a8da9a389ac13f8c40 Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Sat, 8 Jan 2022 21:10:56 +0100 Subject: [PATCH 27/48] [fix] Correctly handle userinfo containing the at sign --- index.js | 37 ++++++++++++++++++++++------ test/test.js | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 98 insertions(+), 7 deletions(-) diff --git a/index.js b/index.js index 702308b..b819461 100644 --- a/index.js +++ b/index.js @@ -304,7 +304,11 @@ function Url(address, location, parser) { if (parse !== parse) { url[key] = address; } else if ('string' === typeof parse) { - if (~(index = address.indexOf(parse))) { + index = parse === '@' + ? address.lastIndexOf(parse) + : address.indexOf(parse); + + if (~index) { if ('number' === typeof instruction[2]) { url[key] = address.slice(0, index); address = address.slice(index + instruction[2]); @@ -370,10 +374,21 @@ function Url(address, location, parser) { // Parse down the `auth` for the username and password. // url.username = url.password = ''; + if (url.auth) { - instruction = url.auth.split(':'); - url.username = instruction[0]; - url.password = instruction[1] || ''; + index = url.auth.indexOf(':'); + + if (~index) { + url.username = url.auth.slice(0, index); + url.username = encodeURIComponent(decodeURIComponent(url.username)); + + url.password = url.auth.slice(index + 1); + url.password = encodeURIComponent(decodeURIComponent(url.password)) + } else { + url.username = encodeURIComponent(decodeURIComponent(url.auth)); + } + + url.auth = url.password ? url.username +':'+ url.password : url.username; } url.origin = url.protocol !== 'file:' && isSpecial(url.protocol) && url.host @@ -465,9 +480,17 @@ function set(part, value, fn) { break; case 'auth': - var splits = value.split(':'); - url.username = splits[0]; - url.password = splits.length === 2 ? splits[1] : ''; + var index = value.indexOf(':'); + + if (~index) { + url.username = value.slice(0, index); + url.username = encodeURIComponent(decodeURIComponent(url.username)); + + url.password = value.slice(index + 1); + url.password = encodeURIComponent(decodeURIComponent(url.password)); + } else { + url.username = encodeURIComponent(decodeURIComponent(value)); + } } for (var i = 0; i < rules.length; i++) { diff --git a/test/test.js b/test/test.js index 8130081..18f16ef 100644 --- a/test/test.js +++ b/test/test.js @@ -689,6 +689,54 @@ describe('url-parse', function () { assume(parsed.hostname).equals('www.example.com'); assume(parsed.href).equals(url); }); + + it('handles @ in username', function () { + var url = 'http://user@@www.example.com/' + , parsed = parse(url); + + assume(parsed.protocol).equals('http:'); + assume(parsed.auth).equals('user%40'); + assume(parsed.username).equals('user%40'); + assume(parsed.password).equals(''); + assume(parsed.hostname).equals('www.example.com'); + assume(parsed.pathname).equals('/'); + assume(parsed.href).equals('http://user%40@www.example.com/'); + + url = 'http://user%40@www.example.com/'; + parsed = parse(url); + + assume(parsed.protocol).equals('http:'); + assume(parsed.auth).equals('user%40'); + assume(parsed.username).equals('user%40'); + assume(parsed.password).equals(''); + assume(parsed.hostname).equals('www.example.com'); + assume(parsed.pathname).equals('/'); + assume(parsed.href).equals('http://user%40@www.example.com/'); + }); + + it('handles @ in password', function () { + var url = 'http://user@:pas:s@@www.example.com/' + , parsed = parse(url); + + assume(parsed.protocol).equals('http:'); + assume(parsed.auth).equals('user%40:pas%3As%40'); + assume(parsed.username).equals('user%40'); + assume(parsed.password).equals('pas%3As%40'); + assume(parsed.hostname).equals('www.example.com'); + assume(parsed.pathname).equals('/'); + assume(parsed.href).equals('http://user%40:pas%3As%40@www.example.com/'); + + url = 'http://user%40:pas%3As%40@www.example.com/' + parsed = parse(url); + + assume(parsed.protocol).equals('http:'); + assume(parsed.auth).equals('user%40:pas%3As%40'); + assume(parsed.username).equals('user%40'); + assume(parsed.password).equals('pas%3As%40'); + assume(parsed.hostname).equals('www.example.com'); + assume(parsed.pathname).equals('/'); + assume(parsed.href).equals('http://user%40:pas%3As%40@www.example.com/'); + }); }); it('accepts multiple ???', function () { @@ -1124,6 +1172,26 @@ describe('url-parse', function () { assume(data.username).equals(''); assume(data.password).equals('quux'); assume(data.href).equals('https://:quux@example.com/'); + + assume(data.set('auth', 'user@:pass@')).equals(data); + assume(data.username).equals('user%40'); + assume(data.password).equals('pass%40'); + assume(data.href).equals('https://user%40:pass%40@example.com/'); + + assume(data.set('auth', 'user%40:pass%40')).equals(data); + assume(data.username).equals('user%40'); + assume(data.password).equals('pass%40'); + assume(data.href).equals('https://user%40:pass%40@example.com/'); + + assume(data.set('auth', 'user:pass:word')).equals(data); + assume(data.username).equals('user'); + assume(data.password).equals('pass%3Aword'); + assume(data.href).equals('https://user:pass%3Aword@example.com/'); + + assume(data.set('auth', 'user:pass%3Aword')).equals(data); + assume(data.username).equals('user'); + assume(data.password).equals('pass%3Aword'); + assume(data.href).equals('https://user:pass%3Aword@example.com/'); }); it('updates other values', function () { From 4e53a8cad35c25e0004cee3afc1ed37ce47cad83 Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Fri, 11 Feb 2022 21:15:41 +0100 Subject: [PATCH 28/48] [doc] Document that the returned hostname might be invalid --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 94f08d1..b476ed7 100644 --- a/README.md +++ b/README.md @@ -80,8 +80,8 @@ The returned `url` instance contains the following properties: - `auth`: Authentication information portion (e.g. `username:password`). - `username`: Username of basic authentication. - `password`: Password of basic authentication. -- `host`: Host name with port number. -- `hostname`: Host name without port number. +- `host`: Host name with port number. The hostname might be invalid. +- `hostname`: Host name without port number. This might be an invalid hostname. - `port`: Optional port number. - `pathname`: URL path. - `query`: Parsed object containing query string, unless parsing is set to false. From 319851bf1c294796fc73e29ff31b14d9084e4a0d Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Sun, 13 Feb 2022 08:53:54 +0100 Subject: [PATCH 29/48] [fix] Remove CR, HT, and LF Copy the behavior of browser `URL` interface and remove CR, HT, and LF from the input URL. --- index.js | 3 +++ test/test.js | 38 ++++++++++++++++++++++++++++++++++++-- 2 files changed, 39 insertions(+), 2 deletions(-) diff --git a/index.js b/index.js index 702308b..4cd646f 100644 --- a/index.js +++ b/index.js @@ -2,6 +2,7 @@ var required = require('requires-port') , qs = require('querystringify') + , CRHTLF = /[\n\r\t]/g , slashes = /^[A-Za-z][A-Za-z0-9+-.]*:\/\// , protocolre = /^([a-z][a-z0-9.+-]*:)?(\/\/)?([\\/]+)?([\S\s]*)/i , windowsDriveLetter = /^[a-zA-Z]:/ @@ -135,6 +136,7 @@ function isSpecial(scheme) { */ function extractProtocol(address, location) { address = trimLeft(address); + address = address.replace(CRHTLF, ''); location = location || {}; var match = protocolre.exec(address); @@ -235,6 +237,7 @@ function resolve(relative, base) { */ function Url(address, location, parser) { address = trimLeft(address); + address = address.replace(CRHTLF, ''); if (!(this instanceof Url)) { return new Url(address, location, parser); diff --git a/test/test.js b/test/test.js index 8130081..2799280 100644 --- a/test/test.js +++ b/test/test.js @@ -102,7 +102,7 @@ describe('url-parse', function () { }); it('does not truncate the input string', function () { - var input = 'foo\nbar\rbaz\u2028qux\u2029'; + var input = 'foo\x0bbar\x0cbaz\u2028qux\u2029'; assume(parse.extractProtocol(input)).eql({ slashes: false, @@ -113,7 +113,16 @@ describe('url-parse', function () { }); it('trimsLeft', function () { - assume(parse.extractProtocol(' javascript://foo')).eql({ + assume(parse.extractProtocol('\x0b\x0c javascript://foo')).eql({ + slashes: true, + protocol: 'javascript:', + rest: 'foo', + slashesCount: 2 + }); + }); + + it('removes CR, HT, and LF', function () { + assume(parse.extractProtocol('jav\n\rasc\nript\r:/\t/fo\no')).eql({ slashes: true, protocol: 'javascript:', rest: 'foo', @@ -408,6 +417,31 @@ describe('url-parse', function () { assume(parsed.href).equals('//example.com'); }); + it('removes CR, HT, and LF', function () { + var parsed = parse( + 'ht\ntp://a\rb:\tcd@exam\rple.com:80\t80/pat\thname?fo\no=b\rar#ba\tz' + ); + + assume(parsed.protocol).equals('http:'); + assume(parsed.username).equals('ab'); + assume(parsed.password).equals('cd'); + assume(parsed.host).equals('example.com:8080'); + assume(parsed.hostname).equals('example.com'); + assume(parsed.port).equals('8080'); + assume(parsed.pathname).equals('/pathname'); + assume(parsed.query).equals('?foo=bar'); + assume(parsed.hash).equals('#baz'); + assume(parsed.href).equals( + 'http://ab:cd@example.com:8080/pathname?foo=bar#baz' + ); + + parsed = parse('s\nip:al\rice@atl\tanta.com'); + + assume(parsed.protocol).equals('sip:'); + assume(parsed.pathname).equals('alice@atlanta.com'); + assume(parsed.href).equals('sip:alice@atlanta.com'); + }); + describe('origin', function () { it('generates an origin property', function () { var url = 'http://google.com:80/pathname' From 193b44baf3d203560735e05eedc99d8244c9e16c Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Sun, 13 Feb 2022 09:14:05 +0100 Subject: [PATCH 30/48] [minor] Simplify whitespace regex --- index.js | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/index.js b/index.js index 4cd646f..02c86e7 100644 --- a/index.js +++ b/index.js @@ -6,8 +6,7 @@ var required = require('requires-port') , slashes = /^[A-Za-z][A-Za-z0-9+-.]*:\/\// , protocolre = /^([a-z][a-z0-9.+-]*:)?(\/\/)?([\\/]+)?([\S\s]*)/i , windowsDriveLetter = /^[a-zA-Z]:/ - , whitespace = '[\\x09\\x0A\\x0B\\x0C\\x0D\\x20\\xA0\\u1680\\u180E\\u2000\\u2001\\u2002\\u2003\\u2004\\u2005\\u2006\\u2007\\u2008\\u2009\\u200A\\u202F\\u205F\\u3000\\u2028\\u2029\\uFEFF]' - , left = new RegExp('^'+ whitespace +'+'); + , whitespace = /^[ \f\n\r\t\v\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]+/; /** * Trim a given string. @@ -16,7 +15,7 @@ var required = require('requires-port') * @public */ function trimLeft(str) { - return (str ? str : '').toString().replace(left, ''); + return (str ? str : '').toString().replace(whitespace, ''); } /** From e4a5807d95b971577e4d888f5b99d64a40851386 Mon Sep 17 00:00:00 2001 From: Martijn Swaagman Date: Sun, 13 Feb 2022 11:37:14 +0100 Subject: [PATCH 31/48] 1.5.5 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index b777acb..f079c10 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "url-parse", - "version": "1.5.4", + "version": "1.5.5", "description": "Small footprint URL parser that works seamlessly across Node.js and browser environments", "main": "index.js", "scripts": { From 4c9fa234c01dca52698666378360ad2fdfb05470 Mon Sep 17 00:00:00 2001 From: Martijn Swaagman Date: Sun, 13 Feb 2022 16:25:42 +0100 Subject: [PATCH 32/48] 1.5.6 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index f079c10..cf472f5 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "url-parse", - "version": "1.5.5", + "version": "1.5.6", "description": "Small footprint URL parser that works seamlessly across Node.js and browser environments", "main": "index.js", "scripts": { From e6fa43422c52f34c73146552ec9916125dc59525 Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Sun, 13 Feb 2022 20:21:27 +0100 Subject: [PATCH 33/48] [security] Add credits for incorrect handling of userinfo vulnerability --- SECURITY.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index f85d48f..f3e7892 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -33,6 +33,14 @@ acknowledge your responsible disclosure, if you wish. ## History +> Incorrect handling of username and password can lead to authorization bypass. + +- **Reporter credits** + - ranjit-git + - GitHub: [@ranjit-git](https://github.com/ranjit-git) +- Huntr report: https://www.huntr.dev/bounties/6d1bc51f-1876-4f5b-a2c2-734e09e8e05b/ +- Fixed in: 1.5.6 + > url-parse mishandles certain uses of a single (back) slash such as https:\ & > https:/ and interprets the URI as a relative path. Browsers accept a single > backslash after the protocol, and treat it as a normal slash, while url-parse From 78e9f2f41285d83e7d91706be5bd439656fe3bc3 Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Sun, 13 Feb 2022 20:40:49 +0100 Subject: [PATCH 34/48] [security] Fix nits --- SECURITY.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index f3e7892..af05717 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -41,14 +41,16 @@ acknowledge your responsible disclosure, if you wish. - Huntr report: https://www.huntr.dev/bounties/6d1bc51f-1876-4f5b-a2c2-734e09e8e05b/ - Fixed in: 1.5.6 +--- + > url-parse mishandles certain uses of a single (back) slash such as https:\ & > https:/ and interprets the URI as a relative path. Browsers accept a single > backslash after the protocol, and treat it as a normal slash, while url-parse > sees it as a relative path. - **Reporter credits** - - Ready-Research - - GitHub: [@Ready-Reserach](https://github.com/ready-research) + - ready-research + - GitHub: [@ready-research](https://github.com/ready-research) - Huntr report: https://www.huntr.dev/bounties/1625557993985-unshiftio/url-parse/ - Fixed in: 1.5.2 From 88df2346855f70cec9713b362ca32a4691dc271a Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Wed, 16 Feb 2022 19:00:41 +0100 Subject: [PATCH 35/48] [doc] Add soft deprecation notice --- README.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/README.md b/README.md index b476ed7..e5bf8d7 100644 --- a/README.md +++ b/README.md @@ -4,6 +4,12 @@ [![Sauce Test Status](https://saucelabs.com/browser-matrix/url-parse.svg)](https://saucelabs.com/u/url-parse) +**`url-parse` was created in 2014 when the WHATWG URL API was not available in +Node.js and the `URL` interface was supported only in some browsers. Today this +is no longer true. The `URL` interface is available in all supported Node.js +release lines and basically all browsers. Consider using it for better security +and accuracy.** + The `url-parse` method exposes two different API interfaces. The [`url`](https://nodejs.org/api/url.html) interface that you know from Node.js and the new [`URL`](https://developer.mozilla.org/en-US/docs/Web/API/URL/URL) From ef45a1355375a8244063793a19059b4f62fc8788 Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Wed, 16 Feb 2022 19:05:36 +0100 Subject: [PATCH 36/48] [fix] Readd the empty userinfo to `url.href` (#226) If the userinfo is present but empty, the parsed host is also empty, and `url.pathname` is not `'/'`, then readd the empty userinfo to `url.href`, otherwise the original invalid URL might be transformed into a valid one with `url.pathname` as host. --- index.js | 11 ++++++++++ test/test.js | 59 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 70 insertions(+) diff --git a/index.js b/index.js index 517b6b6..d808b13 100644 --- a/index.js +++ b/index.js @@ -539,6 +539,17 @@ function toString(stringify) { } else if (url.password) { result += ':'+ url.password; result += '@'; + } else if ( + url.protocol !== 'file:' && + isSpecial(url.protocol) && + !url.host && + url.pathname !== '/' + ) { + // + // Add back the empty userinfo, otherwise the original invalid URL + // might be transformed into a valid one with `url.pathname` as host. + // + result += '@'; } result += url.host + url.pathname; diff --git a/test/test.js b/test/test.js index 6d53eb9..98880b3 100644 --- a/test/test.js +++ b/test/test.js @@ -771,6 +771,65 @@ describe('url-parse', function () { assume(parsed.pathname).equals('/'); assume(parsed.href).equals('http://user%40:pas%3As%40@www.example.com/'); }); + + it('adds @ to href if auth and host are empty', function () { + var parsed, i = 0; + var urls = [ + 'http:@/127.0.0.1', + 'http::@/127.0.0.1', + 'http:/@/127.0.0.1', + 'http:/:@/127.0.0.1', + 'http://@/127.0.0.1', + 'http://:@/127.0.0.1', + 'http:///@/127.0.0.1', + 'http:///:@/127.0.0.1' + ]; + + for (; i < urls.length; i++) { + parsed = parse(urls[i]); + + assume(parsed.protocol).equals('http:'); + assume(parsed.auth).equals(''); + assume(parsed.username).equals(''); + assume(parsed.password).equals(''); + assume(parsed.host).equals(''); + assume(parsed.hostname).equals(''); + assume(parsed.pathname).equals('/127.0.0.1'); + assume(parsed.origin).equals('null'); + assume(parsed.href).equals('http://@/127.0.0.1'); + assume(parsed.toString()).equals('http://@/127.0.0.1'); + } + + urls = [ + 'http:@/', + 'http:@', + 'http::@/', + 'http::@', + 'http:/@/', + 'http:/@', + 'http:/:@/', + 'http:/:@', + 'http://@/', + 'http://@', + 'http://:@/', + 'http://:@' + ]; + + for (i = 0; i < urls.length; i++) { + parsed = parse(urls[i]); + + assume(parsed.protocol).equals('http:'); + assume(parsed.auth).equals(''); + assume(parsed.username).equals(''); + assume(parsed.password).equals(''); + assume(parsed.host).equals(''); + assume(parsed.hostname).equals(''); + assume(parsed.pathname).equals('/'); + assume(parsed.origin).equals('null'); + assume(parsed.href).equals('http:///'); + assume(parsed.toString()).equals('http:///'); + } + }); }); it('accepts multiple ???', function () { From 8b3f5f2c88a4cfc2880f2319c307994cb25bb10a Mon Sep 17 00:00:00 2001 From: Martijn Swaagman Date: Wed, 16 Feb 2022 21:02:02 +0100 Subject: [PATCH 37/48] 1.5.7 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index cf472f5..7bddf4e 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "url-parse", - "version": "1.5.6", + "version": "1.5.7", "description": "Small footprint URL parser that works seamlessly across Node.js and browser environments", "main": "index.js", "scripts": { From 4f2ae676fe0482eb8354e21b63b080924c84350c Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Thu, 17 Feb 2022 09:09:28 +0100 Subject: [PATCH 38/48] [security] Add credits for CVE-2022-0639 --- SECURITY.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index af05717..1a7cee6 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -33,6 +33,18 @@ acknowledge your responsible disclosure, if you wish. ## History +> A specially crafted URL with empty userinfo and no host can be used to bypass +> authorization checks. + +- **Reporter credits** + - Haxatron + - GitHub: [@haxatron](https://github.com/haxatron) + - Twitter: [@haxatron1](https://twitter.com/haxatron1) +- Huntr report: https://www.huntr.dev/bounties/83a6bc9a-b542-4a38-82cd-d995a1481155/ +- Fixed in: 1.5.7 + +--- + > Incorrect handling of username and password can lead to authorization bypass. - **Reporter credits** From d5c64791ef496ca5459ae7f2176a31ea53b127e5 Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Fri, 18 Feb 2022 22:26:18 +0100 Subject: [PATCH 39/48] [fix] Handle the case where the port is specified but empty --- index.js | 13 ++++++++++--- test/test.js | 22 ++++++++++++++++++++++ 2 files changed, 32 insertions(+), 3 deletions(-) diff --git a/index.js b/index.js index d808b13..c5a2a11 100644 --- a/index.js +++ b/index.js @@ -39,7 +39,7 @@ var rules = [ ['/', 'pathname'], // Extract from the back. ['@', 'auth', 1], // Extract from the front. [NaN, 'host', undefined, 1, 1], // Set left over value. - [/:(\d+)$/, 'port', undefined, 1], // RegExp the back. + [/:(\d*)$/, 'port', undefined, 1], // RegExp the back. [NaN, 'hostname', undefined, 1, 1] // Set left over. ]; @@ -524,6 +524,7 @@ function toString(stringify) { var query , url = this + , host = url.host , protocol = url.protocol; if (protocol && protocol.charAt(protocol.length - 1) !== ':') protocol += ':'; @@ -542,7 +543,7 @@ function toString(stringify) { } else if ( url.protocol !== 'file:' && isSpecial(url.protocol) && - !url.host && + !host && url.pathname !== '/' ) { // @@ -552,7 +553,13 @@ function toString(stringify) { result += '@'; } - result += url.host + url.pathname; + // + // Trailing colon is removed from `url.host` when it is parsed. If it still + // ends with a colon, then add back the trailing colon that was removed. This + // prevents an invalid URL from being transformed into a valid one. + // + if (host[host.length - 1] === ':') host += ':'; + result += host + url.pathname; query = 'object' === typeof url.query ? stringify(url.query) : url.query; if (query) result += '?' !== query.charAt(0) ? '?'+ query : query; diff --git a/test/test.js b/test/test.js index 98880b3..ab2c6c3 100644 --- a/test/test.js +++ b/test/test.js @@ -442,6 +442,28 @@ describe('url-parse', function () { assume(parsed.href).equals('sip:alice@atlanta.com'); }); + it('handles the case where the port is specified but empty', function () { + var parsed = parse('http://example.com:'); + + assume(parsed.protocol).equals('http:'); + assume(parsed.port).equals(''); + assume(parsed.host).equals('example.com'); + assume(parsed.hostname).equals('example.com'); + assume(parsed.pathname).equals('/'); + assume(parsed.origin).equals('http://example.com'); + assume(parsed.href).equals('http://example.com/'); + + parsed = parse('http://example.com::'); + + assume(parsed.protocol).equals('http:'); + assume(parsed.port).equals(''); + assume(parsed.host).equals('example.com:'); + assume(parsed.hostname).equals('example.com:'); + assume(parsed.pathname).equals('/'); + assume(parsed.origin).equals('http://example.com:'); + assume(parsed.href).equals('http://example.com::/'); + }); + describe('origin', function () { it('generates an origin property', function () { var url = 'http://google.com:80/pathname' From bb0104d6439cf7c2662afbd9411e0772a9639664 Mon Sep 17 00:00:00 2001 From: Martijn Swaagman Date: Sat, 19 Feb 2022 18:40:01 +0100 Subject: [PATCH 40/48] 1.5.8 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 7bddf4e..507c0e0 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "url-parse", - "version": "1.5.7", + "version": "1.5.8", "description": "Small footprint URL parser that works seamlessly across Node.js and browser environments", "main": "index.js", "scripts": { From 61864a8eccff714a45d23db85a814e3c6ee0baba Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Sat, 19 Feb 2022 20:36:59 +0100 Subject: [PATCH 41/48] [security] Add credits for CVE-2022-0686 --- SECURITY.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index 1a7cee6..d062b4f 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -33,6 +33,17 @@ acknowledge your responsible disclosure, if you wish. ## History +> A URL with a specified but empty port can be used to bypass authorization +> checks. + +- **Reporter credits** + - Rohan Sharma + - GitHub: [@r0hansh](https://github.com/r0hansh) +- Huntr report: https://www.huntr.dev/bounties/55fd06cd-9054-4d80-83be-eb5a454be78c/ +- Fixed in: 1.5.8 + +--- + > A specially crafted URL with empty userinfo and no host can be used to bypass > authorization checks. From 0e3fb542d60ddbf6933f22eb9b1e06e25eaa5b63 Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Sun, 20 Feb 2022 08:48:07 +0100 Subject: [PATCH 42/48] [fix] Strip all control characters from the beginning of the URL --- index.js | 2 +- test/test.js | 10 ++++++++-- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/index.js b/index.js index c5a2a11..aa71e5d 100644 --- a/index.js +++ b/index.js @@ -6,7 +6,7 @@ var required = require('requires-port') , slashes = /^[A-Za-z][A-Za-z0-9+-.]*:\/\// , protocolre = /^([a-z][a-z0-9.+-]*:)?(\/\/)?([\\/]+)?([\S\s]*)/i , windowsDriveLetter = /^[a-zA-Z]:/ - , whitespace = /^[ \f\n\r\t\v\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]+/; + , whitespace = /^[\x00-\x20\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]+/; /** * Trim a given string. diff --git a/test/test.js b/test/test.js index ab2c6c3..f85ebb6 100644 --- a/test/test.js +++ b/test/test.js @@ -47,8 +47,14 @@ describe('url-parse', function () { assume(parse.trimLeft).is.a('function'); }); - it('removes whitespace on the left', function () { - assume(parse.trimLeft(' lol')).equals('lol'); + it('removes control characters on the left', function () { + var i = 0; + var prefix = '' + + for (; i < 33; i++) { + prefix = String.fromCharCode(i); + assume(parse.trimLeft(prefix + prefix +'lol')).equals('lol'); + } }); it('calls toString on a given value', function () { From ad23357ad5fd9a6b011d049466e9ecff723e52b8 Mon Sep 17 00:00:00 2001 From: Martijn Swaagman Date: Sun, 20 Feb 2022 17:15:48 +0100 Subject: [PATCH 43/48] 1.5.9 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 507c0e0..4a3614f 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "url-parse", - "version": "1.5.8", + "version": "1.5.9", "description": "Small footprint URL parser that works seamlessly across Node.js and browser environments", "main": "index.js", "scripts": { From d547792414a414b2f341a805141beafee728addf Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Sun, 20 Feb 2022 21:30:17 +0100 Subject: [PATCH 44/48] [security] Add credits for CVE-2022-0691 --- SECURITY.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index d062b4f..f642347 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -33,6 +33,18 @@ acknowledge your responsible disclosure, if you wish. ## History +> Leading control characters are not removed. This allows an attacker to bypass +> hostname checks and makes the `extractProtocol` method return false positives. + +- **Reporter credits** + - Haxatron + - GitHub: [@haxatron](https://github.com/haxatron) + - Twitter: [@haxatron1](https://twitter.com/haxatron1) +- Huntr report: https://www.huntr.dev/bounties/57124ed5-4b68-4934-8325-2c546257f2e4/ +- Fixed in: 1.5.9 + +--- + > A URL with a specified but empty port can be used to bypass authorization > checks. From a7044e3e8bb2308ac0f74264d01951aeaca0d66f Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Sun, 20 Feb 2022 21:59:14 +0100 Subject: [PATCH 45/48] [minor] Use more descriptive variable name --- index.js | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/index.js b/index.js index aa71e5d..ec6091a 100644 --- a/index.js +++ b/index.js @@ -2,11 +2,11 @@ var required = require('requires-port') , qs = require('querystringify') + , controlOrWhitespace = /^[\x00-\x20\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]+/ , CRHTLF = /[\n\r\t]/g , slashes = /^[A-Za-z][A-Za-z0-9+-.]*:\/\// , protocolre = /^([a-z][a-z0-9.+-]*:)?(\/\/)?([\\/]+)?([\S\s]*)/i - , windowsDriveLetter = /^[a-zA-Z]:/ - , whitespace = /^[\x00-\x20\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]+/; + , windowsDriveLetter = /^[a-zA-Z]:/; /** * Trim a given string. @@ -15,7 +15,7 @@ var required = require('requires-port') * @public */ function trimLeft(str) { - return (str ? str : '').toString().replace(whitespace, ''); + return (str ? str : '').toString().replace(controlOrWhitespace, ''); } /** From 00714900ea1e8ba0a1f87b9f8399001e47f060ec Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Sun, 20 Feb 2022 22:00:41 +0100 Subject: [PATCH 46/48] [doc] Update JSDoc comment --- index.js | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/index.js b/index.js index ec6091a..9093098 100644 --- a/index.js +++ b/index.js @@ -9,9 +9,11 @@ var required = require('requires-port') , windowsDriveLetter = /^[a-zA-Z]:/; /** - * Trim a given string. + * Remove control characters and whitespace from the beginning of a string. * - * @param {String} str String to trim. + * @param {Object|String} str String to trim. + * @returns {String} A new string representing `str` stripped of control + * characters and whitespace from its beginning. * @public */ function trimLeft(str) { From ce7a01f2e10738b17812f57c7b6b5de4ea4c0298 Mon Sep 17 00:00:00 2001 From: Luigi Pinca Date: Mon, 21 Feb 2022 10:28:26 +0100 Subject: [PATCH 47/48] [fix] Improve handling of empty port Make `Url.prototype.toString()` add a trailing colon to the host if the hostname ends with a port number and the parsed port is empty. Refs: https://github.com/unshiftio/url-parse/commit/d5c64791ef49 --- index.js | 8 ++++++-- test/test.js | 20 ++++++++++++++++++++ 2 files changed, 26 insertions(+), 2 deletions(-) diff --git a/index.js b/index.js index 9093098..b86c29f 100644 --- a/index.js +++ b/index.js @@ -5,6 +5,7 @@ var required = require('requires-port') , controlOrWhitespace = /^[\x00-\x20\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]+/ , CRHTLF = /[\n\r\t]/g , slashes = /^[A-Za-z][A-Za-z0-9+-.]*:\/\// + , port = /:\d+$/ , protocolre = /^([a-z][a-z0-9.+-]*:)?(\/\/)?([\\/]+)?([\S\s]*)/i , windowsDriveLetter = /^[a-zA-Z]:/; @@ -452,7 +453,7 @@ function set(part, value, fn) { case 'host': url[part] = value; - if (/:\d+$/.test(value)) { + if (port.test(value)) { value = value.split(':'); url.port = value.pop(); url.hostname = value.join(':'); @@ -560,7 +561,10 @@ function toString(stringify) { // ends with a colon, then add back the trailing colon that was removed. This // prevents an invalid URL from being transformed into a valid one. // - if (host[host.length - 1] === ':') host += ':'; + if (host[host.length - 1] === ':' || (port.test(url.hostname) && !url.port)) { + host += ':'; + } + result += host + url.pathname; query = 'object' === typeof url.query ? stringify(url.query) : url.query; diff --git a/test/test.js b/test/test.js index f85ebb6..4108fe6 100644 --- a/test/test.js +++ b/test/test.js @@ -468,6 +468,26 @@ describe('url-parse', function () { assume(parsed.pathname).equals('/'); assume(parsed.origin).equals('http://example.com:'); assume(parsed.href).equals('http://example.com::/'); + + parsed = parse('http://example.com:8080:'); + + assume(parsed.protocol).equals('http:'); + assume(parsed.port).equals(''); + assume(parsed.host).equals('example.com:8080'); + assume(parsed.hostname).equals('example.com:8080'); + assume(parsed.pathname).equals('/'); + assume(parsed.origin).equals('http://example.com:8080'); + assume(parsed.href).equals('http://example.com:8080:/'); + + parsed = parse('http://example.com:8000:8080'); + + assume(parsed.protocol).equals('http:'); + assume(parsed.port).equals('8080'); + assume(parsed.host).equals('example.com:8000:8080'); + assume(parsed.hostname).equals('example.com:8000'); + assume(parsed.pathname).equals('/'); + assume(parsed.origin).equals('http://example.com:8000:8080'); + assume(parsed.href).equals('http://example.com:8000:8080/'); }); describe('origin', function () { From 8cd4c6c6435c1ea32243ec20c9cfe535251ec524 Mon Sep 17 00:00:00 2001 From: Martijn Swaagman Date: Tue, 22 Feb 2022 16:48:35 +0100 Subject: [PATCH 48/48] 1.5.10 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 4a3614f..8d1bbbe 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "url-parse", - "version": "1.5.9", + "version": "1.5.10", "description": "Small footprint URL parser that works seamlessly across Node.js and browser environments", "main": "index.js", "scripts": {