GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — doc: deprecate url.parse() · nodejs/node@19a9099

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

doc/api
- deprecations.md
- url.md

Expand file treeCollapse file tree

Open diff view settings

Collapse file

`‎doc/api/deprecations.md‎`

Copy file name to clipboardExpand all lines: doc/api/deprecations.md

+22-3Lines changed: 22 additions & 3 deletions

Display the source diff
Display the rich diff

Original file line number	Diff line number	Diff line change
`@@ -2288,6 +2288,9 @@ future release.`
`2288`	`2288`
`2289`	`2289`	`<!-- YAML`
`2290`	`2290`	`changes:`
	`2291`	`+ - version: REPLACEME`
	`2292`	`+ pr-url: https://github.com/nodejs/node/pull/44919`
	`2293`	+ description: \`url.parse()` is deprecated again in DEP0169.
`2291`	`2294`	`- version:`
`2292`	`2295`	`- v15.13.0`
`2293`	`2296`	`- v14.17.0`
`@@ -2300,7 +2303,7 @@ changes:`
`2300`	`2303`
`2301`	`2304`	`Type: Deprecation revoked`
`2302`	`2305`
`2303`		-The [Legacy URL API][] is deprecated. This includes [`url.format()`][],
	`2306`	+The [legacy URL API][] is deprecated. This includes [`url.format()`][],
`2304`	`2307`	[`url.parse()`][], [`url.resolve()`][], and the [legacy `urlObject`][]. Please
`2305`	`2308`	`use the [WHATWG URL API][] instead.`
`2306`	`2309`
`@@ -3258,7 +3261,7 @@ changes:`
`3258`	`3261`	`description: Runtime deprecation.`
`3259`	`3262`	`-->`
`3260`	`3263`
`3261`		`-Type: Runtime.`
	`3264`	`+Type: Runtime`
`3262`	`3265`
`3263`	`3266`	`The implicit suppression of uncaught exceptions in Node-API callbacks is now`
`3264`	`3267`	`deprecated.`
@@ -3267,7 +3270,22 @@ Set the flag [`--force-node-api-uncaught-exceptions-policy`][] to force Node.js
`3267`	`3270`	to emit an [`'uncaughtException'`][] event if the exception is not handled in
`3268`	`3271`	`Node-API callbacks.`
`3269`	`3272`
`3270`		`-[Legacy URL API]: url.md#legacy-url-api`
	`3273`	`+### DEP0169: Insecure url.parse()`
	`3274`	`+`
	`3275`	`+<!-- YAML`
	`3276`	`+changes:`
	`3277`	`+ - version:`
	`3278`	`+ - REPLACEME`
	`3279`	`+ pr-url: https://github.com/nodejs/node/pull/44919`
	`3280`	`+ description: Documentation-only deprecation.`
	`3281`	`+-->`
	`3282`	`+`
	`3283`	`+Type: Documentation-only`
	`3284`	`+`
	`3285`	+[`url.parse()`][] behavior is not standardized and prone to errors that
	`3286`	`+have security implications. Use the [WHATWG URL API][] instead. CVEs are not`
	`3287`	+issued for `url.parse()` vulnerabilities.
	`3288`	`+`
`3271`	`3289`	`[NIST SP 800-38D]: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf`
`3272`	`3290`	`[RFC 6066]: https://tools.ietf.org/html/rfc6066#section-3`
`3273`	`3291`	`[RFC 8247 Section 2.4]: https://www.rfc-editor.org/rfc/rfc8247#section-2.4`
`@@ -3413,6 +3431,7 @@ Node-API callbacks.`
`3413`	`3431`	`[alloc_unsafe_size]: buffer.md#static-method-bufferallocunsafesize`
`3414`	`3432`	`[from_arraybuffer]: buffer.md#static-method-bufferfromarraybuffer-byteoffset-length`
`3415`	`3433`	`[from_string_encoding]: buffer.md#static-method-bufferfromstring-encoding`
	`3434`	`+[legacy URL API]: url.md#legacy-url-api`
`3416`	`3435`	[legacy `urlObject`]: url.md#legacy-urlobject
`3417`	`3436`	[static methods of `crypto.Certificate()`]: crypto.md#class-certificate
`3418`	`3437`	`[subpath exports]: packages.md#subpath-exports`

Collapse file

`‎doc/api/url.md‎`

Copy file name to clipboardExpand all lines: doc/api/url.md

+9-13Lines changed: 9 additions & 13 deletions

Display the source diff
Display the rich diff

Original file line number	Diff line number	Diff line change
@@ -27,7 +27,7 @@ The `node:url` module provides two APIs for working with URLs: a legacy API that
`27`	`27`	`is Node.js specific, and a newer API that implements the same`
`28`	`28`	`[WHATWG URL Standard][] used by web browsers.`
`29`	`29`
`30`		`-A comparison between the WHATWG and Legacy APIs is provided below. Above the URL`
	`30`	`+A comparison between the WHATWG and legacy APIs is provided below. Above the URL`
`31`	`31`	`'https://user:[email protected]:8080/p/a/t/h?query=string#hash'`, properties
`32`	`32`	of an object returned by the legacy `url.parse()` are shown. Below it are
`33`	`33`	properties of a WHATWG `URL` object.
`@@ -63,7 +63,7 @@ const myURL =`
`63`	`63`	`new URL('https://user:[email protected]:8080/p/a/t/h?query=string#hash');`
`64`	`64`	```
`65`	`65`
`66`		`-Parsing the URL string using the Legacy API:`
	`66`	`+Parsing the URL string using the legacy API:`
`67`	`67`
`68`	`68`	```mjs
`69`	`69`	`import url from 'node:url';`
`@@ -1521,6 +1521,9 @@ The formatting process operates as follows:`
`1521`	`1521`	`<!-- YAML`
`1522`	`1522`	`added: v0.1.25`
`1523`	`1523`	`changes:`
	`1524`	`+ - version: REPLACEME`
	`1525`	`+ pr-url: https://github.com/nodejs/node/pull/44919`
	`1526`	`+ description: Documentation-only deprecation.`
`1524`	`1527`	`- version:`
`1525`	`1528`	`- v15.13.0`
`1526`	`1529`	`- v14.17.0`
`@@ -1540,7 +1543,7 @@ changes:`
`1540`	`1543`	`when no query string is present.`
`1541`	`1544`	`-->`
`1542`	`1545`
`1543`		`-> Stability: 3 - Legacy: Use the WHATWG URL API instead.`
	`1546`	`+> Stability: 0 - Deprecated: Use the WHATWG URL API instead.`
`1544`	`1547`
`1545`	`1548`	* `urlString` {string} The URL string to parse.
`1546`	`1549`	* `parseQueryString` {boolean} If `true`, the `query` property will always
@@ -1562,16 +1565,9 @@ A `URIError` is thrown if the `auth` property is present but cannot be decoded.
`1562`	`1565`
`1563`	`1566`	`url.parse()` uses a lenient, non-standard algorithm for parsing URL
`1564`	`1567`	`strings. It is prone to security issues such as [host name spoofing][]`
`1565`		`-and incorrect handling of usernames and passwords.`
`1566`		`-`
`1567`		-`url.parse()` is an exception to most of the legacy APIs. Despite its security
`1568`		`-concerns, it is legacy and not deprecated because it is:`
`1569`		`-`
`1570`		-* Faster than the alternative WHATWG `URL` parser.
`1571`		-* Easier to use with regards to relative URLs than the alternative WHATWG `URL` API.
`1572`		`-* Widely relied upon within the npm ecosystem.`
`1573`		`-`
`1574`		`-Use with caution.`
	`1568`	`+and incorrect handling of usernames and passwords. Do not use with untrusted`
	`1569`	+input. CVEs are not issued for `url.parse()` vulnerabilities. Use the
	`1570`	`+[WHATWG URL][] API instead.`
`1575`	`1571`
`1576`	`1572`	### `url.resolve(from, to)`
`1577`	`1573`

0 commit comments

Comments

0 (0)

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.