Skip to content

Commit a1ad8bc

Browse files
committed
fix(parse): treat backslash as forwardslash in scheme delimiter
make `https:/\attacker.com` like `https:\/attacker.com` result in `https://attacker.com/`
1 parent d7bb4ce commit a1ad8bc

File tree

2 files changed

+50
-1
lines changed

2 files changed

+50
-1
lines changed

src/URI.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -526,7 +526,7 @@
526526
if (parts.protocol && !parts.protocol.match(URI.protocol_expression)) {
527527
// : may be within the path
528528
parts.protocol = undefined;
529-
} else if (string.substring(pos + 1, pos + 3) === '//') {
529+
} else if (string.substring(pos + 1, pos + 3).replace(/\\/g, '/') === '//') {
530530
string = string.substring(pos + 3);
531531

532532
// extract "user:pass@host:port"

test/urls.js

+49
Original file line numberDiff line numberDiff line change
@@ -2082,6 +2082,55 @@ var urls = [{
20822082
idn: false,
20832083
punycode: false
20842084
}
2085+
}, {
2086+
name: 'backslashes protocol',
2087+
url: 'https:/\\attacker.com',
2088+
_url: 'https://attacker.com/',
2089+
parts: {
2090+
protocol: 'https',
2091+
username: null,
2092+
password: null,
2093+
hostname: 'attacker.com',
2094+
port: null,
2095+
path: '/',
2096+
query: null,
2097+
fragment: null
2098+
},
2099+
accessors: {
2100+
protocol: 'https',
2101+
username: '',
2102+
password: '',
2103+
port: '',
2104+
path: '/',
2105+
query: '',
2106+
fragment: '',
2107+
resource: '/',
2108+
authority: 'attacker.com',
2109+
origin: 'https://attacker.com',
2110+
userinfo: '',
2111+
subdomain: '',
2112+
domain: 'attacker.com',
2113+
tld: 'com',
2114+
directory: '/',
2115+
filename: '',
2116+
suffix: '',
2117+
hash: '',
2118+
search: '',
2119+
host: 'attacker.com',
2120+
hostname: 'attacker.com'
2121+
},
2122+
is: {
2123+
urn: false,
2124+
url: true,
2125+
relative: false,
2126+
name: true,
2127+
sld: false,
2128+
ip: false,
2129+
ip4: false,
2130+
ip6: false,
2131+
idn: false,
2132+
punycode: false
2133+
}
20852134
}
20862135
];
20872136

0 commit comments

Comments
 (0)