Skip to content

Commit

Permalink
url: Escape all unwise characters
Browse files Browse the repository at this point in the history
This makes node's http URL handling logic identical to Chrome's

Re #5284
  • Loading branch information
isaacs committed Apr 12, 2013
1 parent 061151c commit 17a379e
Show file tree
Hide file tree
Showing 2 changed files with 13 additions and 3 deletions.
5 changes: 2 additions & 3 deletions lib/url.js
Original file line number Diff line number Diff line change
Expand Up @@ -57,13 +57,12 @@ var protocolPattern = /^([a-z0-9.+-]+:)/i,
unwise = ['{', '}', '|', '\\', '^', '~', '`'].concat(delims),

// Allowed by RFCs, but cause of XSS attacks. Always escape these.
autoEscape = ['\''].concat(delims),
autoEscape = ['\''].concat(unwise),
// Characters that are never ever allowed in a hostname.
// Note that any invalid chars are also handled, but these
// are the ones that are *expected* to be seen, so we fast-path
// them.
nonHostChars = ['%', '/', '?', ';', '#']
.concat(unwise).concat(autoEscape),
nonHostChars = ['%', '/', '?', ';', '#'].concat(autoEscape),
nonAuthChars = ['/', '@', '?', '#'].concat(delims),
hostnameMaxLen = 255,
hostnamePartPattern = /^[a-z0-9A-Z_-]{0,63}$/,
Expand Down
11 changes: 11 additions & 0 deletions test/simple/test-url.js
Original file line number Diff line number Diff line change
Expand Up @@ -741,6 +741,17 @@ var parseTests = {
'path': '/test',
},

'http://x:1/\' <>"`/{}|\\^~`/': {
protocol: 'http:',
slashes: true,
host: 'x:1',
port: '1',
hostname: 'x',
pathname: '/%27%20%3C%3E%22%60/%7B%7D%7C%5C%5E%7E%60/',
path: '/%27%20%3C%3E%22%60/%7B%7D%7C%5C%5E%7E%60/',
href: 'http://x:1/%27%20%3C%3E%22%60/%7B%7D%7C%5C%5E%7E%60/'
},

};

for (var u in parseTests) {
Expand Down

0 comments on commit 17a379e

Please sign in to comment.