url: throw for invalid values to url.format #1036

tellnes · 2015-03-03T03:46:46Z

(Original title: "url: fix passing undefined to url.format")

'use strict' changes the behavior for Function.prototype.call when
the context is undefined. In earlier versions of node the value
undefined would make url.format look for fields in the global scope.

Fixes: #1033

vkurchatkin · 2015-03-03T03:54:21Z

In earlier versions of node the value undefined would make url.format look for fields in the global scope.

That's actually a bug isn't it? Current behaviour seems to be better

cjihrig · 2015-03-03T03:55:58Z

Why not throw if the input isn't a string or object? That seems more predictable.

tellnes · 2015-03-03T04:00:45Z

Yes, that should be classified as a bug in earlier node versions. Including v0.12.0.

This changes removes the TypeError we started getting after introducing strict mode and always return an empty string for falsey values. That is probably how people expect it to behave. I don't think anyone expect it to look for values in global scope or throw.

tellnes · 2015-03-03T04:02:13Z

@cjihrig To throw is maybe a better solution, but I think that will break more code than just return an empty string.

cjihrig · 2015-03-03T04:06:05Z

An argument could be made against breaking code, but IMO this is still a bug fix. Code will be broken if people are relying on incorrect behavior. The fix also only handles falsey values. There are many truthy values that are incorrect here. I'm also working under the assumption that core's philosophy has been to throw immediately on invalid inputs (although this is not enforced 100% of the time).

tellnes · 2015-03-03T04:14:49Z

Actually there is only a problem with null and undefined. As fare as I know, all other values will be converted to an Object when we are calling Function.prototype.call.

I do agree that throwing is a better solution, but if we are going to change it to throw for everything which is not a string or an object, then this will be a breaking change and needs a semver-major.

brendanashworth · 2015-03-03T05:38:42Z

+1 for throwing a TypeError.
I don't think it'd be semver-major, as the first few words of the url.format documentation are:

Take a parsed URL object ...

That its taking any other value would be a bug clear to any developer who read the docs.

tellnes · 2015-03-03T14:51:45Z

Ok, maybe we should get some comments from others about if we should throw or just return an empty string.

cc @iojs/collaborators

mscdex · 2015-03-03T14:58:59Z

If we're strictly expecting an object, I'd think a better check would be something like typeof obj !== 'object' || obj === null

tellnes · 2015-03-03T15:01:36Z

@mscdex Also see the code commit below my change.

julianduque · 2015-03-03T15:24:00Z

I'm +1 on throwing TypeError rather than return an empty string

chrisdickinson · 2015-03-03T18:31:42Z

Throw a TypeError. This really only stands a chance to break already broken code (either it was already throwing a TypeError due to strict mode, or it was looking up properties off of global scope!) I'd put it down as semver-patch.

tellnes · 2015-03-03T18:35:00Z

I suppose this should be left intact

  // ensure it's an object, and not a string url.
  // If it's an obj, this is a no-op.
  // this way, you can call url_format() on strings
  // to clean up potentially wonky urls.
  if (typeof obj === 'string') obj = urlParse(obj);

tellnes · 2015-03-03T19:01:26Z

Ok, I've changed it to throw for all input values except object excluding null and strings.

trevnorris · 2015-03-03T20:06:24Z

lib/url.js

@@ -353,6 +353,13 @@ function urlFormat(obj) {
  // this way, you can call url_format() on strings
  // to clean up potentially wonky urls.
  if (typeof obj === 'string') obj = urlParse(obj);
+
+  if (typeof obj !== 'object')
+    throw new TypeError('Parameter `urlObj` must be an object, not ' +


please use quotes instead of backticks. :)

trevnorris · 2015-03-03T20:07:31Z

Two minor things, but LGTM otherwise.

tellnes · 2015-03-03T20:19:11Z

Minor things fixed

trevnorris · 2015-03-03T20:38:52Z

anyone else have anything to say?

cjihrig · 2015-03-03T21:26:45Z

lib/url.js

@@ -353,6 +353,13 @@ function urlFormat(obj) {
  // this way, you can call url_format() on strings
  // to clean up potentially wonky urls.
  if (typeof obj === 'string') obj = urlParse(obj);
+
+  if (typeof obj !== 'object')


Optional: If urlParse() guarantees to return an object, then you could avoid these two checks by making them else ifs. If you opt for a simpler error message, you could combine the two into one else.

I did choose to use only if for readability, but yes, I should probably change it to else if for speed.
Also, I did prefer the explicit error message over one else if.

i'd suggest a third way, a ternary statement:

if (typeof obj !== 'object' || obj === null) throw new TypeError("Parameter 'urlObj' must be an object, not " + obj === null ? "null" : typeof obj);

I'd recommend saving typeof obj above. There are several repetitions. The ternary on the error looks like a fine solution otherwise.

V8 has pattern-matching logic for if (typeof(value) === 'type') guards. Storing the result of typeof(value) in a local before comparing kills that.

@bnoordhuis Does that also match for situations like eg. how the code is now which is else if (typeof obj !== 'object' || obj === null)?

@tellnes Yes, that's fine.

tellnes · 2015-03-04T13:33:49Z

Combined the two ifs and also changed the following if to an else if.

trevnorris · 2015-03-04T17:15:28Z

/cc @iojs/collaborators

mscdex · 2015-03-04T18:41:30Z

LGTM

julianduque · 2015-03-04T20:51:50Z

LGTM

`'use strict'` changes the behavior for `Function.prototype.call` when the context is `undefined`. In earlier versions of node the value `undefined` would make `url.format` look for fields in the global scope. The docs states that `url.format` takes a parsed URL object and returns a formatted URL string. So with this change it will now throw for other values. The exception is if the input is a string. Then it will call `url.parse` on the string and then format it. The reason for that is that you can call `url.format` on strings to clean up potentially wonky urls. Fixes: nodejs#1033 PR-URL: nodejs#1036 Reviewed-By: Trevor Norris <[email protected]> Reviewed-By: Brian White <[email protected]> Reviewed-By: Julian Duque <[email protected]>

tellnes force-pushed the gh-1033 branch from 144e429 to d9819a5 Compare March 3, 2015 19:00

tellnes force-pushed the gh-1033 branch from d9819a5 to 8a1a65a Compare March 3, 2015 20:03

trevnorris reviewed Mar 3, 2015
View reviewed changes

tellnes force-pushed the gh-1033 branch from 8a1a65a to c369a88 Compare March 3, 2015 20:18

tellnes mentioned this pull request Mar 3, 2015

url.format(undefined) fails in io.js, where it works in Node.js (TypeError: Cannot read property 'auth' of undefined) #1033

Closed

tellnes force-pushed the gh-1033 branch from c369a88 to 2db577f Compare March 3, 2015 20:24

tellnes changed the title ~~url: fix passing undefined to url.format~~ url: throw for invalid values to url.format Mar 3, 2015

cjihrig reviewed Mar 3, 2015
View reviewed changes

tellnes force-pushed the gh-1033 branch from 2db577f to 2f75b54 Compare March 4, 2015 13:31

tellnes force-pushed the gh-1033 branch from 2f75b54 to abb00cc Compare March 4, 2015 21:05

tellnes merged commit abb00cc into nodejs:v1.x Mar 4, 2015

tellnes deleted the gh-1033 branch March 4, 2015 21:06

rvagg mentioned this pull request Mar 4, 2015

Release proposal: v1.5.0 #1060

Closed

ChALkeR added the url Issues and PRs related to the legacy built-in url module. label Feb 16, 2016

snyk-bot mentioned this pull request Apr 24, 2023

[Snyk] Fix for 6 vulnerabilities aliscco/alisco-node#130

Open

aliscco mentioned this pull request Nov 30, 2023

[Snyk] Fix for 6 vulnerabilities aliscco/alisco-node#835

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

url: throw for invalid values to url.format #1036

url: throw for invalid values to url.format #1036

tellnes commented Mar 3, 2015

vkurchatkin commented Mar 3, 2015

cjihrig commented Mar 3, 2015

tellnes commented Mar 3, 2015

tellnes commented Mar 3, 2015

cjihrig commented Mar 3, 2015

tellnes commented Mar 3, 2015

brendanashworth commented Mar 3, 2015

tellnes commented Mar 3, 2015

mscdex commented Mar 3, 2015

tellnes commented Mar 3, 2015

julianduque commented Mar 3, 2015

chrisdickinson commented Mar 3, 2015

tellnes commented Mar 3, 2015

tellnes commented Mar 3, 2015

trevnorris Mar 3, 2015

trevnorris commented Mar 3, 2015

tellnes commented Mar 3, 2015

trevnorris commented Mar 3, 2015

cjihrig Mar 3, 2015

tellnes Mar 3, 2015

brendanashworth Mar 4, 2015

trevnorris Mar 4, 2015

bnoordhuis Mar 4, 2015

tellnes Mar 4, 2015

bnoordhuis Mar 4, 2015

tellnes commented Mar 4, 2015

trevnorris commented Mar 4, 2015

mscdex commented Mar 4, 2015

julianduque commented Mar 4, 2015

url: throw for invalid values to url.format #1036

url: throw for invalid values to url.format #1036

Conversation

tellnes commented Mar 3, 2015

vkurchatkin commented Mar 3, 2015

cjihrig commented Mar 3, 2015

tellnes commented Mar 3, 2015

tellnes commented Mar 3, 2015

cjihrig commented Mar 3, 2015

tellnes commented Mar 3, 2015

brendanashworth commented Mar 3, 2015

tellnes commented Mar 3, 2015

mscdex commented Mar 3, 2015

tellnes commented Mar 3, 2015

julianduque commented Mar 3, 2015

chrisdickinson commented Mar 3, 2015

tellnes commented Mar 3, 2015

tellnes commented Mar 3, 2015

Choose a reason for hiding this comment

trevnorris commented Mar 3, 2015

tellnes commented Mar 3, 2015

trevnorris commented Mar 3, 2015

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tellnes commented Mar 4, 2015

trevnorris commented Mar 4, 2015

mscdex commented Mar 4, 2015

julianduque commented Mar 4, 2015