GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — url: improve url.parse() compliance with WHATWG URL by Trott · Pull Request #45011 · nodejs/node

Conversation

@Trott

@Trott Trott commented Oct 15, 2022

Copy link
Copy Markdown
Member

Make the url.parse() hostname parsing closer to that of WHATWG URL parsing. This mitigates for cases where hostname spoofing becomes possible if your code checks the hostname using one API but the library you use to send the request uses the other API.

Concerns about hostname-spoofing were raised and presented in excellent detail by pyozzi-toss ([email protected]/Security-Tech Team in Toss).

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
bricss, pyozzi-toss, g6123, BasixKOR, devjanger, and Imchaemin reacted with thumbs up emoji
All reactions
  • 👍 6 reactions
@Trott
url: improve url.parse() compliance with WHATWG URL
e474cda 
Make the url.parse() hostname parsing closer to that of WHATWG URL
parsing. This mitigates for cases where hostname spoofing becomes
possible if your code checks the hostname using one API but the library
you use to send the request uses the other API.

Concerns about hostname-spoofing were raised and presented in excellent
detail by pyozzi-toss ([email protected]/Security-Tech Team in Toss).
@nodejs-github-bot nodejs-github-bot added needs-ci PRs that need a full CI run. url Issues and PRs related to the legacy built-in url module. labels Oct 15, 2022
@Trott Trott added the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Oct 15, 2022
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Oct 15, 2022
@nodejs-github-bot

nodejs-github-bot commented Oct 15, 2022

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/47278/
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@Trott

Trott commented Oct 15, 2022

Copy link
Copy Markdown
Member Author

Although this could be considered a semver-major breaking change, I'd argue this is a bugfix as the changed behavior would be very much for edge cases only and the current behavior seems not-intuitive and wrong. It is difficult to imagine a legitimate use case that would depend on it. Out of caution, though, we should run CITGM.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@Trott Trott mentioned this pull request Oct 15, 2022
url: improve port validation #45012
Merged
RafaelGSS
RafaelGSS approved these changes Oct 15, 2022
View reviewed changes
anonrig
anonrig approved these changes Oct 15, 2022
View reviewed changes

@anonrig anonrig left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💯

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@anonrig

anonrig commented Oct 15, 2022

Copy link
Copy Markdown
Member

@nodejs/url
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@Trott Trott added author ready PRs with CI started, the required approvals, and no outstanding review comments. and removed author ready PRs with CI started, the required approvals, and no outstanding review comments. labels Oct 15, 2022
@Trott

Trott commented Oct 15, 2022

Copy link
Copy Markdown
Member Author

CITGM: https://ci.nodejs.org/view/Node.js-citgm/job/citgm-smoker/3018/
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
lpinca
lpinca reviewed Oct 15, 2022
View reviewed changes
Comment thread lib/url.js
code > 127;

// Invalid host character
const isValid = (code !== CHAR_FORWARD_SLASH &&

@lpinca lpinca Oct 15, 2022

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is now too lax. It allows code points like U+005E (^), or U+007C (|) forbidden by the URL Standard.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions

@Trott Trott Oct 15, 2022 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Before and after this change url.parse() returns the same result for foo.com^bar.com and foo.com|bar.com. (I agree, though, that it would be better if it threw errors in those cases like it does for WHATWG URL, but that's probably a subsequent change. Small changes to url.parse() will make it easier to back out if we mess up and break something in the ecosystem.)

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions

@Trott Trott Oct 18, 2022

Copy link
Copy Markdown
Member Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is done in #45046.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@Trott

Trott commented Oct 15, 2022

Copy link
Copy Markdown
Member Author

CITGM results look good to me
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@Trott Trott added author ready PRs with CI started, the required approvals, and no outstanding review comments. commit-queue PRs queued for automated landing through the Commit Queue. labels Oct 15, 2022
@nodejs-github-bot nodejs-github-bot removed the commit-queue PRs queued for automated landing through the Commit Queue. label Oct 17, 2022
@nodejs-github-bot
nodejs-github-bot merged commit a8225dd into nodejs:main Oct 17, 2022
@nodejs-github-bot

nodejs-github-bot commented Oct 17, 2022

Copy link
Copy Markdown
Collaborator

Landed in a8225dd
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@Trott
Trott deleted the toss-1 branch October 18, 2022 01:05
RafaelGSS pushed a commit that referenced this pull request Nov 1, 2022
@Trott @RafaelGSS
url: improve url.parse() compliance with WHATWG URL
e9aa6bb 
Make the url.parse() hostname parsing closer to that of WHATWG URL
parsing. This mitigates for cases where hostname spoofing becomes
possible if your code checks the hostname using one API but the library
you use to send the request uses the other API.

Concerns about hostname-spoofing were raised and presented in excellent
detail by pyozzi-toss ([email protected]/Security-Tech Team in Toss).

PR-URL: #45011
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
@RafaelGSS RafaelGSS mentioned this pull request Nov 1, 2022
v19.1.0 proposal #45269
Merged
RafaelGSS pushed a commit that referenced this pull request Nov 10, 2022
@Trott @RafaelGSS
url: improve url.parse() compliance with WHATWG URL
02cff4a 
Make the url.parse() hostname parsing closer to that of WHATWG URL
parsing. This mitigates for cases where hostname spoofing becomes
possible if your code checks the hostname using one API but the library
you use to send the request uses the other API.

Concerns about hostname-spoofing were raised and presented in excellent
detail by pyozzi-toss ([email protected]/Security-Tech Team in Toss).

PR-URL: #45011
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
@ljharb ljharb mentioned this pull request Nov 19, 2022
node 19.1 breaks url.parse #45514
Closed
@ljharb

ljharb commented Nov 19, 2022

Copy link
Copy Markdown
Member

Could this be the cause of #45514?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@Trott

Trott commented Nov 19, 2022

Copy link
Copy Markdown
Member Author

Could this be the cause of #45514?

Reverting #45012 but leaving this in place fixes that bug for me locally, so I don't think this one is the cause.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@JoeTorrey

This comment was marked as spam.

Sign in to view
@danielleadams danielleadams mentioned this pull request Dec 30, 2022
v18.13.0 release proposal #46025
Merged
danielleadams pushed a commit that referenced this pull request Dec 30, 2022
@Trott @danielleadams
url: improve url.parse() compliance with WHATWG URL
d755a12 
Make the url.parse() hostname parsing closer to that of WHATWG URL
parsing. This mitigates for cases where hostname spoofing becomes
possible if your code checks the hostname using one API but the library
you use to send the request uses the other API.

Concerns about hostname-spoofing were raised and presented in excellent
detail by pyozzi-toss ([email protected]/Security-Tech Team in Toss).

PR-URL: #45011
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
danielleadams pushed a commit that referenced this pull request Jan 3, 2023
@Trott @danielleadams
url: improve url.parse() compliance with WHATWG URL
eb81b6f 
Make the url.parse() hostname parsing closer to that of WHATWG URL
parsing. This mitigates for cases where hostname spoofing becomes
possible if your code checks the hostname using one API but the library
you use to send the request uses the other API.

Concerns about hostname-spoofing were raised and presented in excellent
detail by pyozzi-toss ([email protected]/Security-Tech Team in Toss).

PR-URL: #45011
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
@coderabbitai coderabbitai Bot mentioned this pull request Jul 4, 2026
feat: URL取得方式をサーバーAPI化し安全対策を追加 sella-roum/local-learning-quiz-generator#40
Merged
17 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lpinca lpinca lpinca left review comments
@anonrig anonrig anonrig approved these changes
@RafaelGSS RafaelGSS RafaelGSS approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

author ready PRs with CI started, the required approvals, and no outstanding review comments. needs-ci PRs that need a full CI run. url Issues and PRs related to the legacy built-in url module.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

7 participants

@Trott @nodejs-github-bot @anonrig @ljharb @JoeTorrey @lpinca @RafaelGSS
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.