GeezerVison is showing github.com — url: add pending-deprecation to `url.parse()` · nodejs/node@461ef04
File tree
Expand file treeCollapse file tree
Open diff view settings
Expand file treeCollapse file tree
Open diff view settings
Collapse file
Copy file name to clipboardExpand all lines: doc/api/deprecations.md +4-1Lines changed: 4 additions & 1 deletion - Display the source diff
- Display the rich diff
| Original file line number | Diff line number | Diff line change |
|---|
@@ -3280,13 +3280,16 @@ Node-API callbacks. |
3280 | 3280 |
|
3281 | 3281 | <!-- YAML |
3282 | 3282 | changes: |
| 3283 | + - version: REPLACEME |
| 3284 | + pr-url: https://github.com/nodejs/node/pull/47203 |
| 3285 | + description: Added support for `--pending-deprecation`. |
3283 | 3286 | - version: |
3284 | 3287 | - v19.0.0 |
3285 | 3288 | pr-url: https://github.com/nodejs/node/pull/44919 |
3286 | 3289 | description: Documentation-only deprecation. |
3287 | 3290 | --> |
3288 | 3291 |
|
3289 | | -Type: Documentation-only |
| 3292 | +Type: Documentation-only (supports [`--pending-deprecation`][]) |
3290 | 3293 |
|
3291 | 3294 | [`url.parse()`][] behavior is not standardized and prone to errors that |
3292 | 3295 | have security implications. Use the [WHATWG URL API][] instead. CVEs are not |
|
Collapse file
Copy file name to clipboardExpand all lines: lib/url.js +15Lines changed: 15 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -62,6 +62,8 @@ const { |
62 | 62 | formatUrl, |
63 | 63 | } = internalBinding('url'); |
64 | 64 |
|
| 65 | +const { getOptionValue } = require('internal/options'); |
| 66 | + |
65 | 67 | // Original url.parse() API |
66 | 68 |
|
67 | 69 | function Url() { |
@@ -146,7 +148,20 @@ const { |
146 | 148 | CHAR_COLON, |
147 | 149 | } = require('internal/constants'); |
148 | 150 |
|
| 151 | +let urlParseWarned = false; |
| 152 | + |
149 | 153 | function urlParse(url, parseQueryString, slashesDenoteHost) { |
| 154 | + if (!urlParseWarned && getOptionValue('--pending-deprecation')) { |
| 155 | + urlParseWarned = true; |
| 156 | + process.emitWarning( |
| 157 | + '`url.parse()` behavior is not standardized and prone to ' + |
| 158 | + 'errors that have security implications. Use the WHATWG URL API ' + |
| 159 | + 'instead. CVEs are not issued for `url.parse()` vulnerabilities.', |
| 160 | + 'DeprecationWarning', |
| 161 | + 'DEP0169', |
| 162 | + ); |
| 163 | + } |
| 164 | + |
150 | 165 | if (url instanceof Url) return url; |
151 | 166 |
|
152 | 167 | const urlObject = new Url(); |
|