From 9c268d049219462de0792284c504f137751cf198 Mon Sep 17 00:00:00 2001 From: Matteo Collina Date: Mon, 10 Sep 2018 12:57:07 +0200 Subject: [PATCH] url: avoid hostname spoofing w/ javascript protocol CVE-2018-12123 Fixes: https://github.com/nodejs-private/security/issues/205 PR-URL: https://github.com/nodejs-private/node-private/pull/145 Reviewed-By: Ben Noordhuis Reviewed-By: Michael Dawson Reviewed-By: Anna Henningsen --- lib/url.js | 4 ++-- test/parallel/test-url.js | 33 +++++++++++++++++++++++++++++++++ 2 files changed, 35 insertions(+), 2 deletions(-) diff --git a/lib/url.js b/lib/url.js index 980a2b2a1f00f2..0342e5ae2bab2f 100644 --- a/lib/url.js +++ b/lib/url.js @@ -202,13 +202,13 @@ Url.prototype.parse = function(url, parseQueryString, slashesDenoteHost) { if (slashesDenoteHost || proto || hostPattern.test(rest)) { var slashes = rest.charCodeAt(0) === 47/*/*/ && rest.charCodeAt(1) === 47/*/*/; - if (slashes && !(proto && hostlessProtocol[proto])) { + if (slashes && !(proto && hostlessProtocol[lowerProto])) { rest = rest.slice(2); this.slashes = true; } } - if (!hostlessProtocol[proto] && + if (!hostlessProtocol[lowerProto] && (slashes || (proto && !slashedProtocol[proto]))) { // there's a hostname. diff --git a/test/parallel/test-url.js b/test/parallel/test-url.js index 67cbee6a0fead0..b8af7e3e6f1bcc 100644 --- a/test/parallel/test-url.js +++ b/test/parallel/test-url.js @@ -903,6 +903,39 @@ const parseTests = { hostname: 'www.example.com', pathname: '/', path: '/' + }, + + // The following two URLs are the same, but they differ for + // a capital A: it is important that we verify that the protocol + // is checked in a case-insensitive manner. + 'javascript:alert(1);a=\x27@white-listed.com\x27': { + protocol: 'javascript:', + slashes: null, + auth: null, + host: null, + port: null, + hostname: null, + hash: null, + search: null, + query: null, + pathname: "alert(1);a='@white-listed.com'", + path: "alert(1);a='@white-listed.com'", + href: "javascript:alert(1);a='@white-listed.com'" + }, + + 'javAscript:alert(1);a=\x27@white-listed.com\x27': { + protocol: 'javascript:', + slashes: null, + auth: null, + host: null, + port: null, + hostname: null, + hash: null, + search: null, + query: null, + pathname: "alert(1);a='@white-listed.com'", + path: "alert(1);a='@white-listed.com'", + href: "javascript:alert(1);a='@white-listed.com'" } };