Commit 14aa111
doc: provide alternative to url.parse() using WHATWG URL
PR-URL: #59736
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>1 parent f941232 commit 14aa111
1 file changed
Lines changed: 9 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1841,7 +1841,15 @@ A `URIError` is thrown if the `auth` property is present but cannot be decoded. | |||
| 1841 | 1841 | strings. It is prone to security issues such as [host name spoofing][] | |
| 1842 | 1842 | and incorrect handling of usernames and passwords. Do not use with untrusted | |
| 1843 | 1843 | input. CVEs are not issued for `url.parse()` vulnerabilities. Use the | |
| 1844 | - [WHATWG URL][] API instead. | ||
| 1844 | + [WHATWG URL][] API instead, for example: | ||
| 1845 | + | ||
| 1846 | + ```js | ||
| 1847 | + function getURL(req) { | ||
| 1848 | + const proto = req.headers['x-forwarded-proto'] || 'https'; | ||
| 1849 | + const host = req.headers['x-forwarded-host'] || req.headers.host || 'example.com'; | ||
| 1850 | + return new URL(req.url || '/', `${proto}://${host}`); | ||
| 1851 | + } | ||
| 1852 | + ``` | ||
| 1845 | 1853 | ||
| 1846 | 1854 | ### `url.resolve(from, to)` | |
| 1847 | 1855 | ||
0 commit comments