url: improve url.parse() compliance with WHATWG URL - #45011
Conversation
Sorry, something went wrong.
Make the url.parse() hostname parsing closer to that of WHATWG URL parsing. This mitigates for cases where hostname spoofing becomes possible if your code checks the hostname using one API but the library you use to send the request uses the other API. Concerns about hostname-spoofing were raised and presented in excellent detail by pyozzi-toss (pyozzi@toss.im/Security-Tech Team in Toss).
Sorry, something went wrong.
|
Although this could be considered a semver-major breaking change, I'd argue this is a bugfix as the changed behavior would be very much for edge cases only and the current behavior seems not-intuitive and wrong. It is difficult to imagine a legitimate use case that would depend on it. Out of caution, though, we should run CITGM. |
Sorry, something went wrong.
anonrig
left a comment
There was a problem hiding this comment.
💯
Sorry, something went wrong.
|
@nodejs/url |
Sorry, something went wrong.
Sorry, something went wrong.
| code > 127; | ||
|
|
||
| // Invalid host character | ||
| const isValid = (code !== CHAR_FORWARD_SLASH && |
There was a problem hiding this comment.
I think this is now too lax. It allows code points like U+005E (^), or U+007C (|) forbidden by the URL Standard.
Sorry, something went wrong.
There was a problem hiding this comment.
Before and after this change url.parse() returns the same result for foo.com^bar.com and foo.com|bar.com. (I agree, though, that it would be better if it threw errors in those cases like it does for WHATWG URL, but that's probably a subsequent change. Small changes to url.parse() will make it easier to back out if we mess up and break something in the ecosystem.)
Sorry, something went wrong.
There was a problem hiding this comment.
This is done in #45046.
Sorry, something went wrong.
|
CITGM results look good to me |
Sorry, something went wrong.
Make the url.parse() hostname parsing closer to that of WHATWG URL parsing. This mitigates for cases where hostname spoofing becomes possible if your code checks the hostname using one API but the library you use to send the request uses the other API. Concerns about hostname-spoofing were raised and presented in excellent detail by pyozzi-toss (pyozzi@toss.im/Security-Tech Team in Toss). PR-URL: #45011 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Make the url.parse() hostname parsing closer to that of WHATWG URL parsing. This mitigates for cases where hostname spoofing becomes possible if your code checks the hostname using one API but the library you use to send the request uses the other API. Concerns about hostname-spoofing were raised and presented in excellent detail by pyozzi-toss (pyozzi@toss.im/Security-Tech Team in Toss). PR-URL: #45011 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
This comment was marked as spam.
Make the url.parse() hostname parsing closer to that of WHATWG URL parsing. This mitigates for cases where hostname spoofing becomes possible if your code checks the hostname using one API but the library you use to send the request uses the other API. Concerns about hostname-spoofing were raised and presented in excellent detail by pyozzi-toss (pyozzi@toss.im/Security-Tech Team in Toss). PR-URL: #45011 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Make the url.parse() hostname parsing closer to that of WHATWG URL parsing. This mitigates for cases where hostname spoofing becomes possible if your code checks the hostname using one API but the library you use to send the request uses the other API. Concerns about hostname-spoofing were raised and presented in excellent detail by pyozzi-toss (pyozzi@toss.im/Security-Tech Team in Toss). PR-URL: #45011 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Make the url.parse() hostname parsing closer to that of WHATWG URL parsing. This mitigates for cases where hostname spoofing becomes possible if your code checks the hostname using one API but the library you use to send the request uses the other API.
Concerns about hostname-spoofing were raised and presented in excellent detail by pyozzi-toss (pyozzi@toss.im/Security-Tech Team in Toss).