Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
url: trim leading and trailing C0 control chars
Emulate the WHATWHG URL parse behavior of trimming leading and trailing
C0 control characters. This moves url.parse() slightly closer to
WHATWHG URL behavior. The current behavior is possibly insecure for some
uses. (The url.parse() API is marked as Legacy and the documentation
specifically says it has known bugs and insecure behaviors. Still this
change makes a lot of sense.)

This issue was reported by P0cas. https://github.com/P0cas

PR-URL: #42196
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Mestery <mestery@protonmail.com>
Reviewed-By: Anto Aravinth <anto.aravinth.cse@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
  • Loading branch information
Trott authored and danielleadams committed Apr 24, 2022
1 parent c5da1dd commit 962a8ec
Show file tree
Hide file tree
Showing 2 changed files with 16 additions and 6 deletions.
7 changes: 1 addition & 6 deletions lib/url.js
Expand Up @@ -116,7 +116,6 @@ const {
CHAR_TAB,
CHAR_CARRIAGE_RETURN,
CHAR_LINE_FEED,
CHAR_FORM_FEED,
CHAR_NO_BREAK_SPACE,
CHAR_ZERO_WIDTH_NOBREAK_SPACE,
CHAR_HASH,
Expand Down Expand Up @@ -181,11 +180,7 @@ Url.prototype.parse = function parse(url, parseQueryString, slashesDenoteHost) {
const code = url.charCodeAt(i);

// Find first and last non-whitespace characters for trimming
const isWs = code === CHAR_SPACE ||
code === CHAR_TAB ||
code === CHAR_CARRIAGE_RETURN ||
code === CHAR_LINE_FEED ||
code === CHAR_FORM_FEED ||
const isWs = code < 33 ||
code === CHAR_NO_BREAK_SPACE ||
code === CHAR_ZERO_WIDTH_NOBREAK_SPACE;
if (start === -1) {
Expand Down
15 changes: 15 additions & 0 deletions test/parallel/test-url-parse-format.js
Expand Up @@ -977,6 +977,21 @@ const parseTests = {
path: '/everybody',
href: '//fhqwhgads@example.com/everybody#to-the-limit'
},

'\bhttp://example.com/\b': {
protocol: 'http:',
slashes: true,
auth: null,
host: 'example.com',
port: null,
hostname: 'example.com',
hash: null,
search: null,
query: null,
pathname: '/',
path: '/',
href: 'http://example.com/'
}
};

for (const u in parseTests) {
Expand Down

0 comments on commit 962a8ec

Please sign in to comment.