Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Commit 1bc84ce

Browse filesBrowse files
TrottRafaelGSS
authored andcommitted
url: remove \t \n \r in url.parse() similar to WHATWG
WHATWG URL removes tab, new line, and carraige return characters before processing URL strings. To narrow the differences between WHATWG URL and url.parse(), and thus reduce opportunities for host spoofing etc. due to differences between the two APIs, let's do the same with url.parse(). PR-URL: #45116 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
1 parent 85cb4d7 commit 1bc84ce
Copy full SHA for 1bc84ce

File tree

Expand file treeCollapse file tree

2 files changed

+11
-7
lines changed
Open diff view settings
Filter options
Expand file treeCollapse file tree

2 files changed

+11
-7
lines changed
Open diff view settings
Collapse file

‎lib/url.js‎

Copy file name to clipboardExpand all lines: lib/url.js
+4Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -319,6 +319,10 @@ Url.prototype.parse = function parse(url, parseQueryString, slashesDenoteHost) {
319319
case CHAR_TAB:
320320
case CHAR_LINE_FEED:
321321
case CHAR_CARRIAGE_RETURN:
322+
// WHATWG URL removes tabs, newlines, and carriage returns. Let's do that too.
323+
rest = rest.slice(0, i) + rest.slice(i + 1);
324+
i -= 1;
325+
break;
322326
case CHAR_SPACE:
323327
case CHAR_DOUBLE_QUOTE:
324328
case CHAR_PERCENT:
Collapse file

‎test/parallel/test-url-parse-format.js‎

Copy file name to clipboardExpand all lines: test/parallel/test-url-parse-format.js
+7-7Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -853,16 +853,16 @@ const parseTests = {
853853
'http://a\r" \t\n<\'b:b@c\r\nd/e?f': {
854854
protocol: 'http:',
855855
slashes: true,
856-
auth: 'a\r" \t\n<\'b:b',
857-
host: 'c',
856+
auth: 'a" <\'b:b',
857+
host: 'cd',
858858
port: null,
859-
hostname: 'c',
859+
hostname: 'cd',
860860
hash: null,
861861
search: '?f',
862862
query: 'f',
863-
pathname: '%0D%0Ad/e',
864-
path: '%0D%0Ad/e?f',
865-
href: 'http://a%0D%22%20%09%0A%3C\'b:b@c/%0D%0Ad/e?f'
863+
pathname: '/e',
864+
path: '/e?f',
865+
href: 'http://a%22%20%3C\'b:b@cd/e?f'
866866
},
867867

868868
'https://*': {
@@ -1007,7 +1007,7 @@ for (const u in parseTests) {
10071007
assert.deepStrictEqual(
10081008
actual,
10091009
expected,
1010-
`expected ${inspect(expected)}, got ${inspect(actual)}`
1010+
`parsing ${u} and expected ${inspect(expected)} but got ${inspect(actual)}`
10111011
);
10121012
assert.deepStrictEqual(
10131013
spaced,

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.