From a95fb930d0d2bcf8ba3c86f4525d1348e60a7507 Mon Sep 17 00:00:00 2001 From: James M Snell Date: Mon, 6 Jul 2020 12:59:12 -0700 Subject: [PATCH] doc: document security issues with url.parse() Fixes: https://github.com/nodejs/node/issues/31279 PR-URL: https://github.com/nodejs/node/pull/34226 Reviewed-By: Ben Noordhuis Reviewed-By: Anna Henningsen Reviewed-By: Trivikram Kamat --- doc/api/url.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/doc/api/url.md b/doc/api/url.md index 7d493026fd46ea..2bc5ded862a68b 100644 --- a/doc/api/url.md +++ b/doc/api/url.md @@ -1262,6 +1262,12 @@ A `TypeError` is thrown if `urlString` is not a string. A `URIError` is thrown if the `auth` property is present but cannot be decoded. +Use of the legacy `url.parse()` method is discouraged. Users should +use the WHATWG `URL` API. Because the `url.parse()` method uses a +lenient, non-standard algorithm for parsing URL strings, security +issues can be introduced. Specifically, issues with [host name spoofing][] and +incorrect handling of usernames and passwords have been identified. + ### `url.resolve(from, to)`