Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 19a9099

Browse filesBrowse files
TrottTrott
authored
doc: deprecate url.parse()
This is a documentation-deprecation only and it is possible that it will not proceed to a runtime-deprecation any time in the foreseeable future. But url.parse() is not standardized and prone to errors that have security implications. Refs: #44911 (comment) PR-URL: #44919 Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Michael Dawson <midawson@redhat.com> Reviewed-By: Danielle Adams <adamzdanielle@gmail.com>
1 parent 6686d90 commit 19a9099
Copy full SHA for 19a9099

File tree

Expand file treeCollapse file tree

2 files changed

+31
-16
lines changed
Open diff view settings
Filter options
Expand file treeCollapse file tree

2 files changed

+31
-16
lines changed
Open diff view settings
Collapse file

‎doc/api/deprecations.md‎

Copy file name to clipboardExpand all lines: doc/api/deprecations.md
+22-3Lines changed: 22 additions & 3 deletions
  • Display the source diff
  • Display the rich diff
Original file line numberDiff line numberDiff line change
@@ -2288,6 +2288,9 @@ future release.
22882288

22892289
<!-- YAML
22902290
changes:
2291+
- version: REPLACEME
2292+
pr-url: https://github.com/nodejs/node/pull/44919
2293+
description: \`url.parse()` is deprecated again in DEP0169.
22912294
- version:
22922295
- v15.13.0
22932296
- v14.17.0
@@ -2300,7 +2303,7 @@ changes:
23002303

23012304
Type: Deprecation revoked
23022305

2303-
The [Legacy URL API][] is deprecated. This includes [`url.format()`][],
2306+
The [legacy URL API][] is deprecated. This includes [`url.format()`][],
23042307
[`url.parse()`][], [`url.resolve()`][], and the [legacy `urlObject`][]. Please
23052308
use the [WHATWG URL API][] instead.
23062309

@@ -3258,7 +3261,7 @@ changes:
32583261
description: Runtime deprecation.
32593262
-->
32603263

3261-
Type: Runtime.
3264+
Type: Runtime
32623265

32633266
The implicit suppression of uncaught exceptions in Node-API callbacks is now
32643267
deprecated.
@@ -3267,7 +3270,22 @@ Set the flag [`--force-node-api-uncaught-exceptions-policy`][] to force Node.js
32673270
to emit an [`'uncaughtException'`][] event if the exception is not handled in
32683271
Node-API callbacks.
32693272

3270-
[Legacy URL API]: url.md#legacy-url-api
3273+
### DEP0169: Insecure url.parse()
3274+
3275+
<!-- YAML
3276+
changes:
3277+
- version:
3278+
- REPLACEME
3279+
pr-url: https://github.com/nodejs/node/pull/44919
3280+
description: Documentation-only deprecation.
3281+
-->
3282+
3283+
Type: Documentation-only
3284+
3285+
[`url.parse()`][] behavior is not standardized and prone to errors that
3286+
have security implications. Use the [WHATWG URL API][] instead. CVEs are not
3287+
issued for `url.parse()` vulnerabilities.
3288+
32713289
[NIST SP 800-38D]: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf
32723290
[RFC 6066]: https://tools.ietf.org/html/rfc6066#section-3
32733291
[RFC 8247 Section 2.4]: https://www.rfc-editor.org/rfc/rfc8247#section-2.4
@@ -3413,6 +3431,7 @@ Node-API callbacks.
34133431
[alloc_unsafe_size]: buffer.md#static-method-bufferallocunsafesize
34143432
[from_arraybuffer]: buffer.md#static-method-bufferfromarraybuffer-byteoffset-length
34153433
[from_string_encoding]: buffer.md#static-method-bufferfromstring-encoding
3434+
[legacy URL API]: url.md#legacy-url-api
34163435
[legacy `urlObject`]: url.md#legacy-urlobject
34173436
[static methods of `crypto.Certificate()`]: crypto.md#class-certificate
34183437
[subpath exports]: packages.md#subpath-exports
Collapse file

‎doc/api/url.md‎

Copy file name to clipboardExpand all lines: doc/api/url.md
+9-13Lines changed: 9 additions & 13 deletions
  • Display the source diff
  • Display the rich diff
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ The `node:url` module provides two APIs for working with URLs: a legacy API that
2727
is Node.js specific, and a newer API that implements the same
2828
[WHATWG URL Standard][] used by web browsers.
2929

30-
A comparison between the WHATWG and Legacy APIs is provided below. Above the URL
30+
A comparison between the WHATWG and legacy APIs is provided below. Above the URL
3131
`'https://user:pass@sub.example.com:8080/p/a/t/h?query=string#hash'`, properties
3232
of an object returned by the legacy `url.parse()` are shown. Below it are
3333
properties of a WHATWG `URL` object.
@@ -63,7 +63,7 @@ const myURL =
6363
new URL('https://user:pass@sub.example.com:8080/p/a/t/h?query=string#hash');
6464
```
6565

66-
Parsing the URL string using the Legacy API:
66+
Parsing the URL string using the legacy API:
6767

6868
```mjs
6969
import url from 'node:url';
@@ -1521,6 +1521,9 @@ The formatting process operates as follows:
15211521
<!-- YAML
15221522
added: v0.1.25
15231523
changes:
1524+
- version: REPLACEME
1525+
pr-url: https://github.com/nodejs/node/pull/44919
1526+
description: Documentation-only deprecation.
15241527
- version:
15251528
- v15.13.0
15261529
- v14.17.0
@@ -1540,7 +1543,7 @@ changes:
15401543
when no query string is present.
15411544
-->
15421545
1543-
> Stability: 3 - Legacy: Use the WHATWG URL API instead.
1546+
> Stability: 0 - Deprecated: Use the WHATWG URL API instead.
15441547
15451548
* `urlString` {string} The URL string to parse.
15461549
* `parseQueryString` {boolean} If `true`, the `query` property will always
@@ -1562,16 +1565,9 @@ A `URIError` is thrown if the `auth` property is present but cannot be decoded.
15621565

15631566
`url.parse()` uses a lenient, non-standard algorithm for parsing URL
15641567
strings. It is prone to security issues such as [host name spoofing][]
1565-
and incorrect handling of usernames and passwords.
1566-
1567-
`url.parse()` is an exception to most of the legacy APIs. Despite its security
1568-
concerns, it is legacy and not deprecated because it is:
1569-
1570-
* Faster than the alternative WHATWG `URL` parser.
1571-
* Easier to use with regards to relative URLs than the alternative WHATWG `URL` API.
1572-
* Widely relied upon within the npm ecosystem.
1573-
1574-
Use with caution.
1568+
and incorrect handling of usernames and passwords. Do not use with untrusted
1569+
input. CVEs are not issued for `url.parse()` vulnerabilities. Use the
1570+
[WHATWG URL][] API instead.
15751571

15761572
### `url.resolve(from, to)`
15771573

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.