Skip to content

Commit

Permalink
fix(parse): treat backslash as forwardslash in scheme delimiter
Browse files Browse the repository at this point in the history
make `https:/\attacker.com` like `https:\/attacker.com` result in `https://attacker.com/`
  • Loading branch information
rodneyrehm committed Feb 13, 2021
1 parent d7bb4ce commit a1ad8bc
Show file tree
Hide file tree
Showing 2 changed files with 50 additions and 1 deletion.
2 changes: 1 addition & 1 deletion src/URI.js
Original file line number Diff line number Diff line change
Expand Up @@ -526,7 +526,7 @@
if (parts.protocol && !parts.protocol.match(URI.protocol_expression)) {
// : may be within the path
parts.protocol = undefined;
} else if (string.substring(pos + 1, pos + 3) === '//') {
} else if (string.substring(pos + 1, pos + 3).replace(/\\/g, '/') === '//') {
string = string.substring(pos + 3);

// extract "user:pass@host:port"
Expand Down
49 changes: 49 additions & 0 deletions test/urls.js
Original file line number Diff line number Diff line change
Expand Up @@ -2082,6 +2082,55 @@ var urls = [{
idn: false,
punycode: false
}
}, {
name: 'backslashes protocol',
url: 'https:/\\attacker.com',
_url: 'https://attacker.com/',
parts: {
protocol: 'https',
username: null,
password: null,
hostname: 'attacker.com',
port: null,
path: '/',
query: null,
fragment: null
},
accessors: {
protocol: 'https',
username: '',
password: '',
port: '',
path: '/',
query: '',
fragment: '',
resource: '/',
authority: 'attacker.com',
origin: 'https://attacker.com',
userinfo: '',
subdomain: '',
domain: 'attacker.com',
tld: 'com',
directory: '/',
filename: '',
suffix: '',
hash: '',
search: '',
host: 'attacker.com',
hostname: 'attacker.com'
},
is: {
urn: false,
url: true,
relative: false,
name: true,
sld: false,
ip: false,
ip4: false,
ip6: false,
idn: false,
punycode: false
}
}
];

0 comments on commit a1ad8bc

Please sign in to comment.