Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[fix] Threat single forward/barckward slashes as double slashes extracting protocols #207

Closed
wants to merge 2 commits into from

Conversation

3rd-Eden
Copy link
Member

As per title, this ensures that http:/whatever.com and http:\whatever.com are both normalized to http:// protocols. This allows the correct hostname and paths to be extracted from these invalid URL's

Fixes #206

@3rd-Eden 3rd-Eden requested a review from lpinca July 23, 2021 15:35
, protocol = match[1] ? match[1].toLowerCase() : ''
, slashes = !!(match[2] && match[2].length >= 2)
, rest = match[2] && match[2].length === 1 ? '/' + match[3] : match[3];
, slashes = protocol && slash || !!(slash && match[2].length >= 2)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It fails for parse('foo:/bar'). That should return '/bar' as pathaname and not 'bar' as host.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Interestingly we don't have a test case for that, that will complicate things a lot.

@3rd-Eden 3rd-Eden closed this Jul 25, 2021
@lpinca lpinca deleted the single-slash branch July 25, 2021 13:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Security issues Hostname spoofing & Open Redirect
2 participants