GeezerVison is showing github.com — doc: deprecate use of invalid ports in `url.parse` · nodejs/node@b771fdb
File tree
Expand file treeCollapse file tree
Open diff view settings
Expand file treeCollapse file tree
Open diff view settings
Collapse file
Copy file name to clipboardExpand all lines: doc/api/deprecations.md +16Lines changed: 16 additions & 0 deletions - Display the source diff
- Display the rich diff
| Original file line number | Diff line number | Diff line change |
|---|
@@ -3283,6 +3283,22 @@ Type: Documentation-only |
3283 | 3283 | have security implications. Use the [WHATWG URL API][] instead. CVEs are not |
3284 | 3284 | issued for `url.parse()` vulnerabilities. |
3285 | 3285 |
|
| 3286 | +### DEP0170: Invalid port when using `url.parse()` |
| 3287 | + |
| 3288 | +<!-- YAML |
| 3289 | +changes: |
| 3290 | + - version: |
| 3291 | + - REPLACEME |
| 3292 | + pr-url: https://github.com/nodejs/node/pull/45576 |
| 3293 | + description: Documentation-only deprecation. |
| 3294 | +--> |
| 3295 | + |
| 3296 | +Type: Documentation-only |
| 3297 | + |
| 3298 | +[`url.parse()`][] accepts URLs with ports that are not numbers. This behavior |
| 3299 | +might result in host name spoofing with unexpected input. These URLs will throw |
| 3300 | +an error in future versions of Node.js, as the [WHATWG URL API][] does already. |
| 3301 | + |
3286 | 3302 | [NIST SP 800-38D]: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf |
3287 | 3303 | [RFC 6066]: https://tools.ietf.org/html/rfc6066#section-3 |
3288 | 3304 | [RFC 8247 Section 2.4]: https://www.rfc-editor.org/rfc/rfc8247#section-2.4 |
|