Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

doc: document security issues with url.parse() #34226

Closed
wants to merge 3 commits into from
Closed

doc: document security issues with url.parse() #34226

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
061d486
doc: document security issues with url.parse()
jasnell Jul 6, 2020
b7eaab8
[Squash] suggestion
jasnell Jul 7, 2020
81a9ae6
[squash] nits
jasnell Jul 9, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
7 changes: 7 additions & 0 deletions doc/api/url.md
View file
Open in desktop
Expand Up @@ -1262,6 +1262,12 @@ A `TypeError` is thrown if `urlString` is not a string.

A `URIError` is thrown if the `auth` property is present but cannot be decoded.

Use of the legacy `url.parse()` method is not recommended. All users should
jasnell marked this conversation as resolved.
Show resolved Hide resolved
migrate to the WHATWG `URL` api. Because the `url.parse()` method uses a
jasnell marked this conversation as resolved.
Show resolved Hide resolved
lenient, non-standards compliant algorithm for parsing URL strings, security
jasnell marked this conversation as resolved.
Show resolved Hide resolved
issues can be introduced. Specifically, issues with [hostname spoofing][] and
jasnell marked this conversation as resolved.
Show resolved Hide resolved
incorrect handling of user info (usernames and passwords) have been identified.
jasnell marked this conversation as resolved.
Show resolved Hide resolved

### `url.resolve(from, to)`
<!-- YAML
added: v0.1.25
Expand Down Expand Up @@ -1379,6 +1385,7 @@ console.log(myURL.origin);
[WHATWG URL Standard]: https://url.spec.whatwg.org/
[WHATWG URL]: #url_the_whatwg_url_api
[examples of parsed URLs]: https://url.spec.whatwg.org/#example-url-parsing
[hostname spoofing]: https://hackerone.com/reports/678487
jasnell marked this conversation as resolved.
Show resolved Hide resolved
[legacy `urlObject`]: #url_legacy_urlobject
[percent-encoded]: #whatwg-percent-encoding
[stable sorting algorithm]: https://en.wikipedia.org/wiki/Sorting_algorithm#Stability