@noodleseed/one 0.93.0 → 0.94.0

package/node_modules/tldts-core/src/domain-without-suffix.ts

@@ -0,0 +1,14 @@
+/**
+ * Return the part of domain without suffix.
+ *
+ * Example: for domain 'foo.com', the result would be 'foo'.
+ */
+export default function getDomainWithoutSuffix(
+  domain: string,
+  suffix: string,
+): string {
+  // Note: here `domain` and `suffix` cannot have the same length because in
+  // this case we set `domain` to `null` instead. It is thus safe to assume
+  // that `suffix` is shorter than `domain`.
+  return domain.slice(0, -suffix.length - 1);
+}

package/node_modules/tldts-core/src/domain.ts

@@ -0,0 +1,100 @@
+import { IOptions } from './options';
+
+/**
+ * Check if `vhost` is a valid suffix of `hostname` (top-domain)
+ *
+ * It means that `vhost` needs to be a suffix of `hostname` and we then need to
+ * make sure that: either they are equal, or the character preceding `vhost` in
+ * `hostname` is a '.' (it should not be a partial label).
+ *
+ * * hostname = 'not.evil.com' and vhost = 'vil.com'      => not ok
+ * * hostname = 'not.evil.com' and vhost = 'evil.com'     => ok
+ * * hostname = 'not.evil.com' and vhost = 'not.evil.com' => ok
+ */
+function shareSameDomainSuffix(hostname: string, vhost: string): boolean {
+  if (hostname.endsWith(vhost)) {
+    return (
+      hostname.length === vhost.length ||
+      hostname[hostname.length - vhost.length - 1] === '.'
+    );
+  }
+
+  return false;
+}
+
+/**
+ * Given a hostname and its public suffix, extract the general domain.
+ */
+function extractDomainWithSuffix(
+  hostname: string,
+  publicSuffix: string,
+): string {
+  // Locate the index of the last '.' in the part of the `hostname` preceding
+  // the public suffix.
+  //
+  // examples:
+  //   1. not.evil.co.uk  => evil.co.uk
+  //         ^    ^
+  //         |    | start of public suffix
+  //         | index of the last dot
+  //
+  //   2. example.co.uk   => example.co.uk
+  //     ^       ^
+  //     |       | start of public suffix
+  //     |
+  //     | (-1) no dot found before the public suffix
+  const publicSuffixIndex = hostname.length - publicSuffix.length - 2;
+  const lastDotBeforeSuffixIndex = hostname.lastIndexOf('.', publicSuffixIndex);
+
+  // No '.' found, then `hostname` is the general domain (no sub-domain)
+  if (lastDotBeforeSuffixIndex === -1) {
+    return hostname;
+  }
+
+  // Extract the part between the last '.'
+  return hostname.slice(lastDotBeforeSuffixIndex + 1);
+}
+
+/**
+ * Detects the domain based on rules and upon and a host string
+ */
+export default function getDomain(
+  suffix: string,
+  hostname: string,
+  options: IOptions,
+): string | null {
+  // Check if `hostname` ends with a member of `validHosts`.
+  if (options.validHosts !== null) {
+    const validHosts = options.validHosts;
+    for (const vhost of validHosts) {
+      if (/*@__INLINE__*/ shareSameDomainSuffix(hostname, vhost)) {
+        return vhost;
+      }
+    }
+  }
+
+  let numberOfLeadingDots = 0;
+  if (hostname.startsWith('.')) {
+    while (
+      numberOfLeadingDots < hostname.length &&
+      hostname[numberOfLeadingDots] === '.'
+    ) {
+      numberOfLeadingDots += 1;
+    }
+  }
+
+  // If `hostname` is a valid public suffix, then there is no domain to return.
+  // Since we already know that `getPublicSuffix` returns a suffix of `hostname`
+  // there is no need to perform a string comparison and we only compare the
+  // size.
+  if (suffix.length === hostname.length - numberOfLeadingDots) {
+    return null;
+  }
+
+  // To extract the general domain, we start by identifying the public suffix
+  // (if any), then consider the domain to be the public suffix with one added
+  // level of depth. (e.g.: if hostname is `not.evil.co.uk` and public suffix:
+  // `co.uk`, then we take one more level: `evil`, giving the final result:
+  // `evil.co.uk`).
+  return /*@__INLINE__*/ extractDomainWithSuffix(hostname, suffix);
+}

package/node_modules/tldts-core/src/extract-hostname.ts

@@ -0,0 +1,480 @@
+/**
+ * Matches an ASCII tab (U+0009) or newline (U+000A / U+000D). The WHATWG URL
+ * parser strips these before parsing; we only allocate a cleaned copy (and
+ * re-parse) on the rare input that actually contains one.
+ */
+const CONTROL_CHARS = /[\t\n\r]/g;
+
+// Set by `extractHostname` (a module-scope flag, read synchronously by
+// `parseImpl` right after the call — same pattern as the reused RESULT object).
+// `true` ONLY when extraction validated the returned host inline (a confirmed-
+// valid, "simple" authority) so `parseImpl` can skip the separate
+// `isValidHostname` pass. `false` in every other case (validation disabled, a
+// complex authority — userinfo/port/brackets/trailing-dot/control — an invalid
+// host, or a non-main return path); `parseImpl` then validates as usual. The
+// fast path can only ever SKIP a redundant scan for hosts already known valid,
+// never accept an invalid one.
+export let extractedHostnameValidated = false;
+
+/**
+ * True if char `code` is a valid hostname character. This is the per-char half
+ * of `is-valid.ts`'s `isValidAscii` (a-z, 0-9, > U+007F) PLUS three additions:
+ * A-Z (the host is lowercased before validation, so uppercase ≡ a valid
+ * lowercase letter) and '-' / '_' (valid inside a label). KEEP IN SYNC with
+ * `is-valid.ts`: these rules are deliberately duplicated to validate during
+ * extraction, so any change to the accepted character set there must be
+ * mirrored here (and vice-versa).
+ */
+function isValidHostnameChar(code: number): boolean {
+  return (
+    (code >= 97 && code <= 122) || // a-z
+    (code >= 48 && code <= 57) || // 0-9
+    code > 127 || // non-ASCII (accepted, not punycode-checked)
+    (code >= 65 && code <= 90) || // A-Z (becomes valid once lowercased)
+    code === 45 || // '-'
+    code === 95 // '_'
+  );
+}
+
+/**
+ * Classify scheme `url.slice(schemeStart, colonIndex)` as a WHATWG special
+ * scheme without allocating a substring (case-insensitive via `| 32`).
+ * Special schemes: ftp, file, http, https, ws, wss
+ * (https://url.spec.whatwg.org/#special-scheme).
+ *
+ * @returns 0 = not special, 1 = special, 2 = file (its host sits only between
+ *          "//" and the next slash).
+ */
+function getSpecialScheme(
+  url: string,
+  schemeStart: number,
+  colonIndex: number,
+): number {
+  const length = colonIndex - schemeStart;
+  const c0 = url.charCodeAt(schemeStart) | 32;
+  if (length === 2) {
+    return c0 === 119 && (url.charCodeAt(schemeStart + 1) | 32) === 115 ? 1 : 0; // ws
+  } else if (length === 3) {
+    const c1 = url.charCodeAt(schemeStart + 1) | 32;
+    const c2 = url.charCodeAt(schemeStart + 2) | 32;
+    if (c0 === 119 && c1 === 115 && c2 === 115) return 1; // wss
+    if (c0 === 102 && c1 === 116 && c2 === 112) return 1; // ftp
+    return 0;
+  } else if (length === 4) {
+    const c1 = url.charCodeAt(schemeStart + 1) | 32;
+    const c2 = url.charCodeAt(schemeStart + 2) | 32;
+    const c3 = url.charCodeAt(schemeStart + 3) | 32;
+    if (c0 === 104 && c1 === 116 && c2 === 116 && c3 === 112) return 1; // http
+    if (c0 === 102 && c1 === 105 && c2 === 108 && c3 === 101) return 2; // file
+    return 0;
+  } else if (length === 5) {
+    return c0 === 104 &&
+      (url.charCodeAt(schemeStart + 1) | 32) === 116 &&
+      (url.charCodeAt(schemeStart + 2) | 32) === 116 &&
+      (url.charCodeAt(schemeStart + 3) | 32) === 112 &&
+      (url.charCodeAt(schemeStart + 4) | 32) === 115
+      ? 1
+      : 0; // https
+  }
+  return 0;
+}
+
+/**
+ * Extract a hostname from `url`, matching a WHATWG URL parser's host-boundary
+ * behaviour (https://url.spec.whatwg.org/#concept-basic-url-parser) for tldts'
+ * scope. It deliberately does NOT normalise the host (no IDNA/punycode or IPv4
+ * canonicalisation; IPv6 brackets are stripped, not compressed), strips trailing
+ * dots, and stays lenient where a strict parser rejects (bare host:port,
+ * out-of-range port, user@host) — all documented deviations.
+ *
+ * @param urlIsValidHostname - when true, `url` is already a valid hostname and is
+ *   returned by the same reference (factory.ts skips re-validation on that
+ *   identity), keeping the common path allocation-free.
+ * @param validate - when true, validate the host inline during the authority
+ *   scan and publish the verdict via `extractedHostnameValidated` so `parseImpl`
+ *   can skip the redundant `isValidHostname` pass for simple authorities.
+ */
+export default function extractHostname(
+  url: string,
+  urlIsValidHostname: boolean,
+  validate = false,
+): string | null {
+  let start = 0;
+  let end: number = url.length;
+  let hasUpper = false;
+  let isSpecial = false;
+  extractedHostnameValidated = false;
+
+  if (!urlIsValidHostname) {
+    // Data URLs never carry a host (and may be huge — short-circuit them).
+    if (url.startsWith('data:')) {
+      return null;
+    }
+
+    // WHATWG step 1: trim leading/trailing C0 control or space (<= U+0020).
+    // Tab/newline elsewhere are handled lazily below.
+    while (start < url.length && url.charCodeAt(start) <= 32) {
+      start += 1;
+    }
+    while (end > start + 1 && url.charCodeAt(end - 1) <= 32) {
+      end -= 1;
+    }
+
+    if (
+      url.charCodeAt(start) === 47 /* '/' */ &&
+      url.charCodeAt(start + 1) === 47 /* '/' */
+    ) {
+      // Scheme-relative reference ("//host/path").
+      start += 2;
+    } else {
+      const indexOfProtocol = url.indexOf(':/', start);
+      if (indexOfProtocol !== -1) {
+        // "scheme://…". Classify the scheme, then position `start` at the host.
+        const special = getSpecialScheme(url, start, indexOfProtocol);
+        if (special === 1) {
+          // Special scheme: skip the run of '/' and '\' after it
+          // (special-authority-(ignore-)slashes states; '\' acts as '/').
+          isSpecial = true;
+          start = indexOfProtocol + 2;
+          while (
+            url.charCodeAt(start) === 47 /* '/' */ ||
+            url.charCodeAt(start) === 92 /* '\' */
+          ) {
+            start += 1;
+          }
+        } else if (special === 2) {
+          // file: the host is only what sits between "//" and the next slash, so
+          // "file://h/x" => "h" but "file:///x" / "file:/x" => no host.
+          isSpecial = true;
+          start = indexOfProtocol + 1;
+          let slashes = 0;
+          while (
+            (url.charCodeAt(start) === 47 || url.charCodeAt(start) === 92) &&
+            slashes < 2
+          ) {
+            start += 1;
+            slashes += 1;
+          }
+          if (slashes < 2) {
+            return null;
+          }
+        } else {
+          // Unknown scheme: validate the WHATWG scheme grammar [A-Za-z0-9+.-];
+          // a control char means it was split by a tab/newline (strip + re-parse).
+          for (let i = start; i < indexOfProtocol; i += 1) {
+            const code = url.charCodeAt(i) | 32;
+            if (
+              !(
+                (
+                  (code >= 97 && code <= 122) || // [a, z]
+                  (code >= 48 && code <= 57) || // [0, 9]
+                  code === 46 || // '.'
+                  code === 45 || // '-'
+                  code === 43
+                ) // '+'
+              )
+            ) {
+              const raw = url.charCodeAt(i);
+              if (raw === 9 || raw === 10 || raw === 13) {
+                return extractHostname(
+                  url.replace(CONTROL_CHARS, ''),
+                  urlIsValidHostname,
+                  validate,
+                );
+              }
+              return null;
+            }
+          }
+          // A non-special scheme has an authority only after "//" (else it is an
+          // opaque path with no host). `indexOf(':/')` already gave the first '/'.
+          if (url.charCodeAt(indexOfProtocol + 2) === 47 /* '/' */) {
+            start = indexOfProtocol + 3;
+          } else {
+            return null;
+          }
+        }
+      } else if (url.charCodeAt(start) !== 91 /* '[' */) {
+        // Cold path: no scheme "://", and not a bare IPv6 literal (whose first
+        // ':' would otherwise look like a scheme separator; "[…]" falls through
+        // to the ipv6 handling below). May be a bare host, a host:port, a
+        // user@host, a slash-less special scheme ("https:host"), or an opaque
+        // URI ("mailto:", "tel:", "urn:…").
+        let indexOfColon = -1;
+        for (let i = start; i < end; i += 1) {
+          const code = url.charCodeAt(i);
+          if (code === 9 || code === 10 || code === 13) {
+            return extractHostname(
+              url.replace(CONTROL_CHARS, ''),
+              urlIsValidHostname,
+              validate,
+            );
+          }
+          if (code === 58 /* ':' */) {
+            indexOfColon = i;
+            break;
+          }
+          if (code === 47 || code === 92 || code === 63 || code === 35) {
+            break;
+          }
+        }
+
+        if (indexOfColon !== -1) {
+          // An '@' before the next delimiter => the ':' is userinfo, not a
+          // scheme ("user:pass@host", "mailto:a@b"): keep the whole authority.
+          let hasIdentifier = false;
+          for (let i = indexOfColon + 1; i < end; i += 1) {
+            const code = url.charCodeAt(i);
+            if (code === 47 || code === 92 || code === 63 || code === 35) {
+              break;
+            }
+            if (code === 64 /* '@' */) {
+              hasIdentifier = true;
+              break;
+            }
+          }
+
+          if (!hasIdentifier) {
+            // All-digits after ':' => a bare "host:port" (tldts accepts
+            // hostnames too); keep `start` and let the port handling trim it.
+            let allDigits = true;
+            let i = indexOfColon + 1;
+            for (; i < end; i += 1) {
+              const code = url.charCodeAt(i);
+              if (code === 47 || code === 92 || code === 63 || code === 35) {
+                break;
+              }
+              if (code < 48 /* '0' */ || code > 57 /* '9' */) {
+                allDigits = false;
+                break;
+              }
+            }
+            if (i === indexOfColon + 1) {
+              allDigits = false; // nothing after ':' => not a port
+            }
+
+            if (!allDigits) {
+              const special = getSpecialScheme(url, start, indexOfColon);
+              if (special === 0) {
+                // No "://" anywhere on the cold path and not a special scheme.
+                // A second ':' before the host's end marks a bare, unbracketed
+                // IPv6 literal ("2a01:e35::1"): fall through and let the host
+                // loop + isIp classify it. Without one this is an opaque path
+                // with no host ("mailto:x", "foo:bar").
+                let isBareIpv6 = false;
+                for (let j = indexOfColon + 1; j < end; j += 1) {
+                  const code = url.charCodeAt(j);
+                  if (
+                    code === 47 ||
+                    code === 92 ||
+                    code === 63 ||
+                    code === 35
+                  ) {
+                    break;
+                  }
+                  if (code === 58 /* ':' */) {
+                    isBareIpv6 = true;
+                    break;
+                  }
+                }
+                if (!isBareIpv6) {
+                  return null;
+                }
+              } else {
+                isSpecial = true;
+                start = indexOfColon + 1;
+                if (special === 2) {
+                  // file (e.g. "file:\\host"): host only between "//" and next slash.
+                  let slashes = 0;
+                  while (
+                    (url.charCodeAt(start) === 47 ||
+                      url.charCodeAt(start) === 92) &&
+                    slashes < 2
+                  ) {
+                    start += 1;
+                    slashes += 1;
+                  }
+                  if (slashes < 2) {
+                    return null;
+                  }
+                } else {
+                  while (
+                    url.charCodeAt(start) === 47 ||
+                    url.charCodeAt(start) === 92
+                  ) {
+                    start += 1;
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+
+    // Find the host's end: first '/', '?' or '#' (and '\' for special URLs,
+    // which WHATWG treats like '/'). Track the last '@', ']' and ':' for
+    // userinfo, ipv6 and port, plus the first ':' of the host (reset at each
+    // '@') to tell a bare IPv6 (>= 2 colons) from a host:port (exactly one);
+    // flag uppercase and a stray tab/newline. The loop is split on `code < 64`
+    // so common host characters take fewer comparisons.
+    //
+    // When `validate`, also accumulate `is-valid.ts`'s checks over the scanned
+    // run so a simple authority's host can be validated in this single pass.
+    // `vValid` only stays meaningful for a "simple" authority (no userinfo, port,
+    // brackets, control or trailing dot); those cases clear it / are rejected by
+    // the guard below, falling back to `isValidHostname`.
+    let indexOfIdentifier = -1;
+    let indexOfClosingBracket = -1;
+    let indexOfPort = -1;
+    let indexOfFirstColon = -1;
+    let hasControl = false;
+    let vValid = validate; // seeded true when validating; cleared on the first invalid char
+    let vLastDot = start - 1; // mirrors is-valid.ts `lastDotIndex = -1` at host start
+    let vLastCode = -1;
+    if (validate && start < end) {
+      // First-char rule: must be a valid host char, '.', or '_' (NOT '-').
+      const c0 = url.charCodeAt(start);
+      if (
+        !(
+          /*@__INLINE__*/ (
+            isValidHostnameChar(c0) ||
+            c0 === 46 /* '.' */ ||
+            c0 === 95 /* '_' */
+          )
+        ) ||
+        c0 === 45 /* '-' (isValidHostnameChar allows it mid-label, not first) */
+      ) {
+        vValid = false;
+      }
+    }
+    for (let i = start; i < end; i += 1) {
+      const code: number = url.charCodeAt(i);
+      if (code < 64) {
+        if (code === 47 || code === 35 || code === 63) {
+          end = i;
+          break;
+        } else if (code === 58 /* ':' */) {
+          if (indexOfFirstColon === -1) {
+            indexOfFirstColon = i;
+          }
+          indexOfPort = i;
+        } else if (code === 9 || code === 10 || code === 13) {
+          hasControl = true;
+        } else if (validate) {
+          if (code === 46 /* '.' */) {
+            if (i - vLastDot > 64 || vLastCode === 46 || vLastCode === 45) {
+              vValid = false;
+            }
+            vLastDot = i;
+          } else if (code < 48 || code > 57) {
+            // < 64 and not a delimiter/dot/digit => only '-' (45) is a valid
+            // host char here; everything else (space, %, !, etc.) is invalid.
+            // A '-' must also not START a label (the byte right after a '.') —
+            // mirrors is-valid.ts; the first label is covered by the first-char
+            // rule above. (RFC 1034 §3.5 / RFC 1035 §2.3.1 LDH.)
+            if (code !== 45 || vLastCode === 46 /* label-leading '-' */) {
+              vValid = false;
+            }
+          }
+        }
+      } else if (isSpecial && code === 92 /* '\' */) {
+        end = i;
+        break;
+      } else if (code === 64 /* '@' */) {
+        indexOfIdentifier = i;
+        indexOfFirstColon = -1; // colons before '@' are userinfo, not the host
+      } else if (code === 93 /* ']' */) {
+        indexOfClosingBracket = i;
+      } else if (code >= 65 && code <= 90) {
+        hasUpper = true;
+      } else if (validate && !(/*@__INLINE__*/ isValidHostnameChar(code))) {
+        // >= 64, not '@'/']'/upper: valid only if a-z, '_', or non-ASCII.
+        vValid = false;
+      }
+      if (validate) {
+        vLastCode = code;
+      }
+    }
+
+    // A tab/newline inside the authority: strip everything and re-parse (rare).
+    if (hasControl) {
+      return extractHostname(
+        url.replace(CONTROL_CHARS, ''),
+        urlIsValidHostname,
+        validate,
+      );
+    }
+
+    // Skip userinfo. '>= start' so an empty userinfo ("http://@host") works too.
+    if (
+      indexOfIdentifier !== -1 &&
+      indexOfIdentifier >= start &&
+      indexOfIdentifier < end
+    ) {
+      start = indexOfIdentifier + 1;
+    }
+
+    if (url.charCodeAt(start) === 91 /* '[' */) {
+      // ipv6 address: return what is between the brackets, or null if unclosed.
+      if (indexOfClosingBracket !== -1) {
+        return url.slice(start + 1, indexOfClosingBracket).toLowerCase();
+      }
+      return null;
+    } else if (
+      indexOfPort !== -1 &&
+      indexOfPort > start &&
+      indexOfPort < end &&
+      // A host:port has exactly one ':' in the host (so its first ':' is its
+      // last); a bare, unbracketed IPv6 literal ("2a01:e35::1") has >= 2, so
+      // its first ':' precedes the last. Only the former has a ':port' to trim.
+      indexOfFirstColon === indexOfPort
+    ) {
+      end = indexOfPort; // trim ':port'
+    }
+
+    // Empty authority ("http://", "file:///path", "//"); only reachable here via
+    // extraction — a bare valid hostname never lands here.
+    if (start >= end) {
+      return null;
+    }
+
+    // Publish the inline-validation verdict — but only for a "simple" authority,
+    // where the scanned run equals the final host: no userinfo skip, no port
+    // trim, no brackets, no trailing dot (trimmed below), and length within RFC
+    // limits. Anything else leaves it `false` so `parseImpl` re-validates.
+    //
+    // Every clause below is load-bearing for CORRECTNESS, not just speed: the
+    // loop accumulates `vValid` over the whole scanned run (it does not stop at
+    // ':' or '@', so any port/userinfo bytes are included), so the verdict is
+    // only sound when that run equals the final host. Do not drop a clause as
+    // "redundant" — e.g. without `indexOfPort === -1`, `host:8080` would be
+    // wrongly accepted.
+    if (
+      validate &&
+      vValid &&
+      indexOfIdentifier === -1 &&
+      indexOfPort === -1 &&
+      indexOfClosingBracket === -1 &&
+      url.charCodeAt(end - 1) !== 46 /* no trailing dot */ &&
+      end - start <= 255 && // total length
+      end - vLastDot - 1 <= 63 && // last label length
+      vLastCode !== 45 /* last char not '-' */
+    ) {
+      extractedHostnameValidated = true;
+    }
+  }
+
+  // Trim trailing dots
+  while (end > start + 1 && url.charCodeAt(end - 1) === 46 /* '.' */) {
+    end -= 1;
+  }
+
+  const hostname: string =
+    start !== 0 || end !== url.length ? url.slice(start, end) : url;
+
+  if (hasUpper) {
+    return hostname.toLowerCase();
+  }
+
+  return hostname;
+}