Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

url: improve url.parse() compliance with WHATWG URL #45011

Merged
merged 1 commit into from Oct 17, 2022
Merged

url: improve url.parse() compliance with WHATWG URL #45011

merged 1 commit into from Oct 17, 2022

Commits on Oct 15, 2022

  1. url: improve url.parse() compliance with WHATWG URL 

    Make the url.parse() hostname parsing closer to that of WHATWG URL
parsing. This mitigates for cases where hostname spoofing becomes
possible if your code checks the hostname using one API but the library
you use to send the request uses the other API.

Concerns about hostname-spoofing were raised and presented in excellent
detail by pyozzi-toss (pyozzi@toss.im/Security-Tech Team in Toss).
    @Trott
    Trott committed Oct 15, 2022
    Configuration menu
    Copy the full SHA
    e474cda View commit details
    Browse the repository at this point in the history