From a6a656abaa507a1b24195f74a9dcfab29f532917 Mon Sep 17 00:00:00 2001 From: James M Snell Date: Mon, 6 Jul 2020 12:59:12 -0700 Subject: [PATCH] doc: document security issues with url.parse() Fixes: https://github.com/nodejs/node/issues/31279 PR-URL: https://github.com/nodejs/node/pull/34226 Reviewed-By: Ben Noordhuis Reviewed-By: Anna Henningsen Reviewed-By: Trivikram Kamat --- doc/api/url.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/doc/api/url.md b/doc/api/url.md index 06b80a438ad748..53aec1f6596985 100644 --- a/doc/api/url.md +++ b/doc/api/url.md @@ -1244,6 +1244,12 @@ A `TypeError` is thrown if `urlString` is not a string. A `URIError` is thrown if the `auth` property is present but cannot be decoded. +Use of the legacy `url.parse()` method is discouraged. Users should +use the WHATWG `URL` API. Because the `url.parse()` method uses a +lenient, non-standard algorithm for parsing URL strings, security +issues can be introduced. Specifically, issues with [host name spoofing][] and +incorrect handling of usernames and passwords have been identified. + ### `url.resolve(from, to)`