new URL() accepts array of string #41653
Comments
|
This is perhaps a documentation bug but not a bug in the code. The spec indicates that MDN indicates that I tested in Chrome and it happily accepts an array. |
|
@nodejs/url |
|
@Trott's explanation is correct. There's no bug here. The behavior is correct. |
VoltrexKeyva
added
the
whatwg-url
|
As this isn't up to us but the URL standard (as explained by Rich and confirmed by James above - and if you're interested you can check the conversions in the WebIDL spec) - I think it's not something Node can/should fix. If you feel strongly about this - please open an issue in the https://github.com/whatwg/url repo As usual - if anyone feels this should be reopened please do so. |
|
Doc change to clarify this: #41658 |
|
Let's reopen until the doc clarification at #41658 lands then I missed that |
Closes: #41653 PR-URL: #41658 Fixes: #41653 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Mohammed Keyvanzadeh <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Darshan Sen <[email protected]> Reviewed-By: Mestery <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]>
Closes: nodejs#41653 PR-URL: nodejs#41658 Fixes: nodejs#41653 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Mohammed Keyvanzadeh <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Darshan Sen <[email protected]> Reviewed-By: Mestery <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]>
Closes: #41653 PR-URL: #41658 Fixes: #41653 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Mohammed Keyvanzadeh <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Darshan Sen <[email protected]> Reviewed-By: Mestery <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]>
Closes: #41653 PR-URL: #41658 Fixes: #41653 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Mohammed Keyvanzadeh <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Darshan Sen <[email protected]> Reviewed-By: Mestery <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]>
Closes: #41653 PR-URL: #41658 Fixes: #41653 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Mohammed Keyvanzadeh <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Darshan Sen <[email protected]> Reviewed-By: Mestery <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]>
Closes: #41653 PR-URL: #41658 Fixes: #41653 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Mohammed Keyvanzadeh <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Darshan Sen <[email protected]> Reviewed-By: Mestery <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]>
Version
v14.18.2
Platform
macos && ubuntu tested
Subsystem
No response
What steps will reproduce the bug?
Based on documentation and WHATWG URL API
new URL()accepts a string as input. By tests i figured out that an array with single string is also accepted as seen here:i understand this might be accepted but an array with 2 strings is not accepted, more problematic, it returns a VALID URL which should NOT be valid (see screenshot). Moreover same situation applies to Chrome, Firefox (latest versions).
This behaviour might cause a security issue, since especially passing an array with 2 strings does not throw any INVALID_URL error like the 4th case in the screenshot. People might inject stuff and this validation would fail. Even though this might be minor issue on browser, at the server-side this might be major thing
How often does it reproduce? Is there a required condition?
No response
What is the expected behavior?
new URL(Array) should throw
What do you see instead?
Additional information
No response
The text was updated successfully, but these errors were encountered: