Access Restriction Bypass

[mik-patient]

Description Issue:

An authorization bypass vulnerability was found in nodes-url-parse. This flaw allows a remote attacker with a basic user account to evade hostname verification by inserting the at symbol "@" at the end of the password field. This issue can allow entry to systems designed to block remote access and may not have additional defenses. Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.

Overview
url-parse is a Small footprint URL parser that works seamlessly across Node.js and browser environments.
Affected versions of this package are vulnerable to Access Restriction Bypass due to improper parsing process, that may lead to incorrect handling of authentication credentials and hostname, which allows bypass of hostname validation.

PoC:

// PoC.js var parse = require('url-parse') var cc=parse("http://admin:password123@@127.0.0.1") //Output: { slashes: true, protocol: 'http:', hash: '', query: '', pathname: '/', auth: 'admin:password123', host: '@127.0.0.1', port: '', hostname: '@127.0.0.1', password: 'password123', username: 'admin', origin: 'http://@127.0.0.1', href: 'http://admin:password123@@127.0.0.1/' }

GHSA-rqff-837h-mm52
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Severity : Moderate

---

Before we can merge this PR, please make sure that all the following items have been
checked off. If any of the checklist items are not applicable, please leave them but
write a little note why.

• Targeted PR against correct branch (see CONTRIBUTING.md)
• Linked to Github issue with discussion and accepted design OR link to spec that describes this work.
• Code follows the module structure standards.
• Wrote unit and integration tests
• Updated relevant documentation (docs/) or specification (x/<module>/spec/)
• Added relevant godoc comments.
• Added a relevant changelog entry to the Unreleased section in CHANGELOG.md
• Re-reviewed Files changed in the Github PR explorer
• Review Codecov Report in the comment section below once CI passes

[crodriguezvega]

Thanks very much for opening this PR to fix the security vulnerability! It seems that there are no changes anymore now in the PR, so I will just close it. Thanks again!

[crodriguezvega]

Reopening because after we merge this, there might be changes again...