Skip to content

Commit a8166fe

Browse files
committed
fix(parse): handle excessive colons in scheme delimiter
reported by @huydoppa via huntr.dev
1 parent 01920b5 commit a8166fe

File tree

2 files changed

+99
-1
lines changed

2 files changed

+99
-1
lines changed

src/URI.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -517,7 +517,7 @@
517517
}
518518

519519
// slashes and backslashes have lost all meaning for the web protocols (https, http, wss, ws)
520-
string = string.replace(/^(https?|ftp|wss?)?:[/\\]*/i, '$1://');
520+
string = string.replace(/^(https?|ftp|wss?)?:+[/\\]*/i, '$1://');
521521

522522
// extract protocol
523523
if (string.substring(0, 2) === '//') {

test/urls.js

+98
Original file line numberDiff line numberDiff line change
@@ -2620,6 +2620,104 @@ var urls = [{
26202620
idn: false,
26212621
punycode: false
26222622
}
2623+
}, {
2624+
name: 'excessive colon in protocol delimiter',
2625+
url: 'http:://www.example.org:8080/hello:world',
2626+
_url: 'http://www.example.org:8080/hello:world',
2627+
parts: {
2628+
protocol: 'http',
2629+
username: null,
2630+
password: null,
2631+
hostname: 'www.example.org',
2632+
port: '8080',
2633+
path: '/hello:world',
2634+
query: null,
2635+
fragment: null
2636+
},
2637+
accessors: {
2638+
protocol: 'http',
2639+
username: '',
2640+
password: '',
2641+
port: '8080',
2642+
path: '/hello:world',
2643+
query: '',
2644+
fragment: '',
2645+
resource: '/hello:world',
2646+
authority: 'www.example.org:8080',
2647+
origin: 'http://www.example.org:8080',
2648+
userinfo: '',
2649+
subdomain: 'www',
2650+
domain: 'example.org',
2651+
tld: 'org',
2652+
directory: '/',
2653+
filename: 'hello:world',
2654+
suffix: '',
2655+
hash: '', // location.hash style
2656+
search: '', // location.search style
2657+
host: 'www.example.org:8080',
2658+
hostname: 'www.example.org'
2659+
},
2660+
is: {
2661+
urn: false,
2662+
url: true,
2663+
relative: false,
2664+
name: true,
2665+
sld: false,
2666+
ip: false,
2667+
ip4: false,
2668+
ip6: false,
2669+
idn: false,
2670+
punycode: false
2671+
}
2672+
}, {
2673+
name: 'excessive colon in protocol delimiter backslashes',
2674+
url: 'http::\\\\www.example.org:8080/hello:world',
2675+
_url: 'http://www.example.org:8080/hello:world',
2676+
parts: {
2677+
protocol: 'http',
2678+
username: null,
2679+
password: null,
2680+
hostname: 'www.example.org',
2681+
port: '8080',
2682+
path: '/hello:world',
2683+
query: null,
2684+
fragment: null
2685+
},
2686+
accessors: {
2687+
protocol: 'http',
2688+
username: '',
2689+
password: '',
2690+
port: '8080',
2691+
path: '/hello:world',
2692+
query: '',
2693+
fragment: '',
2694+
resource: '/hello:world',
2695+
authority: 'www.example.org:8080',
2696+
origin: 'http://www.example.org:8080',
2697+
userinfo: '',
2698+
subdomain: 'www',
2699+
domain: 'example.org',
2700+
tld: 'org',
2701+
directory: '/',
2702+
filename: 'hello:world',
2703+
suffix: '',
2704+
hash: '', // location.hash style
2705+
search: '', // location.search style
2706+
host: 'www.example.org:8080',
2707+
hostname: 'www.example.org'
2708+
},
2709+
is: {
2710+
urn: false,
2711+
url: true,
2712+
relative: false,
2713+
name: true,
2714+
sld: false,
2715+
ip: false,
2716+
ip4: false,
2717+
ip6: false,
2718+
idn: false,
2719+
punycode: false
2720+
}
26232721
}
26242722
];
26252723

0 commit comments

Comments
 (0)