url: forbid pipe in URL host

Fixes: nodejs#37862
RaisinTen · Mar 23, 2021 · 22c8109 · 22c8109
1 parent 0a77830
commit 22c8109
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 1 deletion.
diff --git a/src/node_url.cc b/src/node_url.cc
@@ -208,7 +208,7 @@ CHAR_TEST(8, IsForbiddenHostCodePoint,
           ch == ' ' || ch == '#' || ch == '%' || ch == '/' ||
           ch == ':' || ch == '?' || ch == '@' || ch == '[' ||
           ch == '<' || ch == '>' || ch == '\\' || ch == ']' ||
-          ch == '^')
+          ch == '^' || ch == '|')
 
 // https://url.spec.whatwg.org/#windows-drive-letter
 TWO_CHAR_STRING_TEST(8, IsWindowsDriveLetter,

diff --git a/test/cctest/test_url.cc b/test/cctest/test_url.cc
@@ -31,6 +31,18 @@ TEST_F(URLTest, Simple) {
   EXPECT_EQ(simple.fragment(), "fragment");
 }
 
+TEST_F(URLTest, Simple1) {
+  URL simple("https://exa|mple.org:81/a/b/c?query#fragment");
+
+  EXPECT_FALSE(simple.flags() & URL_FLAGS_FAILED);
+  EXPECT_EQ(simple.protocol(), "https:");
+  EXPECT_EQ(simple.host(), "exa%7Cmple.org");
+  EXPECT_EQ(simple.port(), 81);
+  EXPECT_EQ(simple.path(), "/a/b/c");
+  EXPECT_EQ(simple.query(), "query");
+  EXPECT_EQ(simple.fragment(), "fragment");
+}
+
 TEST_F(URLTest, Simple2) {
   const char* input = "https://example.org:81/a/b/c?query#fragment";
   URL simple(input, strlen(input));