6bdd2c3884This reverts commit 5f7730e2f2.
This change broke too many edge cases in the ecosystem. Reverting it
re-introduces some host-spoofing possibilities, so we won't want to
revert forever, but the issue is long-lived enough and not sufficiently
critical that we can't wait for a major release to introduce it as a
breaking change. After this lands, I plan to re-introduce this as a
change that throws a warning rather than an error, after which we can
land a semver-major that re-introduces the error and try to get the word
out to maintainers of likely-affected packages.
Closes: https://github.com/nodejs/node/issues/45514
Refs: https://github.com/nodejs/node/pull/45012
PR-URL: https://github.com/nodejs/node/pull/45517
Fixes: https://github.com/nodejs/node/issues/45514
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
76 lines
2.2 KiB
JavaScript
76 lines
2.2 KiB
JavaScript
'use strict';
|
||
const common = require('../common');
|
||
const assert = require('assert');
|
||
const url = require('url');
|
||
|
||
// https://github.com/joyent/node/issues/568
|
||
[
|
||
[undefined, 'undefined'],
|
||
[null, 'object'],
|
||
[true, 'boolean'],
|
||
[false, 'boolean'],
|
||
[0.0, 'number'],
|
||
[0, 'number'],
|
||
[[], 'object'],
|
||
[{}, 'object'],
|
||
[() => {}, 'function'],
|
||
[Symbol('foo'), 'symbol'],
|
||
].forEach(([val, type]) => {
|
||
assert.throws(() => {
|
||
url.parse(val);
|
||
}, {
|
||
code: 'ERR_INVALID_ARG_TYPE',
|
||
name: 'TypeError',
|
||
message: 'The "url" argument must be of type string.' +
|
||
common.invalidArgTypeHelper(val)
|
||
});
|
||
});
|
||
|
||
assert.throws(() => { url.parse('http://%E0%A4%A@fail'); },
|
||
(e) => {
|
||
// The error should be a URIError.
|
||
if (!(e instanceof URIError))
|
||
return false;
|
||
|
||
// The error should be from the JS engine and not from Node.js.
|
||
// JS engine errors do not have the `code` property.
|
||
return e.code === undefined;
|
||
});
|
||
|
||
assert.throws(() => { url.parse('http://[127.0.0.1\x00c8763]:8000/'); },
|
||
{ code: 'ERR_INVALID_URL', input: 'http://[127.0.0.1\x00c8763]:8000/' }
|
||
);
|
||
|
||
if (common.hasIntl) {
|
||
// An array of Unicode code points whose Unicode NFKD contains a "bad
|
||
// character".
|
||
const badIDNA = (() => {
|
||
const BAD_CHARS = '#%/:?@[\\]^|';
|
||
const out = [];
|
||
for (let i = 0x80; i < 0x110000; i++) {
|
||
const cp = String.fromCodePoint(i);
|
||
for (const badChar of BAD_CHARS) {
|
||
if (cp.normalize('NFKD').includes(badChar)) {
|
||
out.push(cp);
|
||
}
|
||
}
|
||
}
|
||
return out;
|
||
})();
|
||
|
||
// The generation logic above should at a minimum produce these two
|
||
// characters.
|
||
assert(badIDNA.includes('℀'));
|
||
assert(badIDNA.includes('＠'));
|
||
|
||
for (const badCodePoint of badIDNA) {
|
||
const badURL = `http://fail${badCodePoint}fail.com/`;
|
||
assert.throws(() => { url.parse(badURL); },
|
||
(e) => e.code === 'ERR_INVALID_URL',
|
||
`parsing ${badURL}`);
|
||
}
|
||
|
||
assert.throws(() => { url.parse('http://\u00AD/bad.com/'); },
|
||
(e) => e.code === 'ERR_INVALID_URL',
|
||
'parsing http://\u00AD/bad.com/');
|
||
}
|