node/test/parallel/test-url-format-whatwg.js
RafaelGSS dabb2f5f0c
src: handle url crash on different url formats
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/816
Refs: https://hackerone.com/reports/3546390
CVE-ID: CVE-2026-21712
2026-03-24 19:46:50 -03:00

157 lines
4 KiB
JavaScript

'use strict';
const { hasIntl } = require('../common');
const assert = require('node:assert');
const url = require('node:url');
const { test } = require('node:test');
const myURL = new URL('http://user:pass@xn--lck1c3crb1723bpq4a.com/a?a=b#c');
test('should format', { skip: !hasIntl }, () => {
assert.strictEqual(
url.format(myURL),
'http://user:pass@xn--lck1c3crb1723bpq4a.com/a?a=b#c'
);
assert.strictEqual(
url.format(myURL, {}),
'http://user:pass@xn--lck1c3crb1723bpq4a.com/a?a=b#c'
);
});
test('handle invalid arguments', { skip: !hasIntl }, () => {
for (const value of [true, 1, 'test', Infinity]) {
assert.throws(
() => url.format(myURL, value),
{
code: 'ERR_INVALID_ARG_TYPE',
name: 'TypeError',
}
);
}
});
test('any falsy value other than undefined will be treated as false', { skip: !hasIntl }, () => {
assert.strictEqual(
url.format(myURL, { auth: false }),
'http://xn--lck1c3crb1723bpq4a.com/a?a=b#c'
);
assert.strictEqual(
url.format(myURL, { auth: '' }),
'http://xn--lck1c3crb1723bpq4a.com/a?a=b#c'
);
assert.strictEqual(
url.format(myURL, { auth: 0 }),
'http://xn--lck1c3crb1723bpq4a.com/a?a=b#c'
);
assert.strictEqual(
url.format(myURL, { auth: 1 }),
'http://user:pass@xn--lck1c3crb1723bpq4a.com/a?a=b#c'
);
assert.strictEqual(
url.format(myURL, { auth: {} }),
'http://user:pass@xn--lck1c3crb1723bpq4a.com/a?a=b#c'
);
assert.strictEqual(
url.format(myURL, { fragment: false }),
'http://user:pass@xn--lck1c3crb1723bpq4a.com/a?a=b'
);
assert.strictEqual(
url.format(myURL, { fragment: '' }),
'http://user:pass@xn--lck1c3crb1723bpq4a.com/a?a=b'
);
assert.strictEqual(
url.format(myURL, { fragment: 0 }),
'http://user:pass@xn--lck1c3crb1723bpq4a.com/a?a=b'
);
assert.strictEqual(
url.format(myURL, { fragment: 1 }),
'http://user:pass@xn--lck1c3crb1723bpq4a.com/a?a=b#c'
);
assert.strictEqual(
url.format(myURL, { fragment: {} }),
'http://user:pass@xn--lck1c3crb1723bpq4a.com/a?a=b#c'
);
assert.strictEqual(
url.format(myURL, { search: false }),
'http://user:pass@xn--lck1c3crb1723bpq4a.com/a#c'
);
assert.strictEqual(
url.format(myURL, { search: '' }),
'http://user:pass@xn--lck1c3crb1723bpq4a.com/a#c'
);
assert.strictEqual(
url.format(myURL, { search: 0 }),
'http://user:pass@xn--lck1c3crb1723bpq4a.com/a#c'
);
assert.strictEqual(
url.format(myURL, { search: 1 }),
'http://user:pass@xn--lck1c3crb1723bpq4a.com/a?a=b#c'
);
assert.strictEqual(
url.format(myURL, { search: {} }),
'http://user:pass@xn--lck1c3crb1723bpq4a.com/a?a=b#c'
);
assert.strictEqual(
url.format(myURL, { unicode: true }),
'http://user:pass@理容ナカムラ.com/a?a=b#c'
);
assert.strictEqual(
url.format(myURL, { unicode: 1 }),
'http://user:pass@理容ナカムラ.com/a?a=b#c'
);
assert.strictEqual(
url.format(myURL, { unicode: {} }),
'http://user:pass@理容ナカムラ.com/a?a=b#c'
);
assert.strictEqual(
url.format(myURL, { unicode: false }),
'http://user:pass@xn--lck1c3crb1723bpq4a.com/a?a=b#c'
);
assert.strictEqual(
url.format(myURL, { unicode: 0 }),
'http://user:pass@xn--lck1c3crb1723bpq4a.com/a?a=b#c'
);
});
test('should format with unicode: true', { skip: !hasIntl }, () => {
assert.strictEqual(
url.format(new URL('http://user:pass@xn--0zwm56d.com:8080/path'), { unicode: true }),
'http://user:pass@测试.com:8080/path'
);
});
test('should format tel: prefix', { skip: !hasIntl }, () => {
assert.strictEqual(
url.format(new URL('tel:123')),
url.format(new URL('tel:123'), { unicode: true })
);
});
// Regression test: url.format should not crash on URLs that ada::url_aggregator
// can parse but ada::url cannot (e.g. special scheme URLs with opaque paths).
test('should not crash on URLs with invalid IDN hostnames', () => {
const u = new URL('ws:xn-\u022B');
// doesNotThrow
url.format(u, { fragment: false, unicode: false, auth: false, search: false });
});