@rho-workspace/rho 0.5.2 → 0.5.3

package/node_modules/fast-uri/test/relative-normalization-security.test.js

@@ -1,156 +0,0 @@
-'use strict'
-
-const test = require('tape')
-const fastURI = require('..')
-
-const ABSOLUTE_BASES = [
-  'http://h/p/q/r',
-  'http://h/',
-  'foo://h/a/b/',
-  'http://h/p/q/'
-]
-
-const RELATIVE_BASES = ['', 'base', 'relative/base']
-
-test('normalize keeps the meaning of relative-path references', (t) => {
-  const cases = [
-    ['a/../b', 'b'],
-    ['x/..', './'],
-    ['../x', '../x'],
-    ['./../x', '../x'],
-    ['a/b/../../..', '..'],
-    ['a/./b', 'a/b'],
-    ['a/b/..', 'a/'],
-    ['.', './'],
-    ['..', '..'],
-    ['../', '../'],
-    ['../../a/./b/../c', '../../a/c'],
-    ['a//..', 'a/'],
-    ['a/../b?q#f', 'b?q#f']
-  ]
-  for (const [input, expected] of cases) {
-    t.equal(fastURI.normalize(input), expected, `${input} -> ${expected}`)
-  }
-  t.end()
-})
-
-test('normalize never turns a relative-path reference into a root or network path', (t) => {
-  t.equal(fastURI.normalize('.//x'), './/x', 'leading empty segment is kept behind "."')
-  t.equal(fastURI.normalize('a/..//x'), './/x', 'collapsed prefix does not expose "//"')
-  t.equal(fastURI.parse(fastURI.normalize('a/..//x')).host, undefined, 'no authority is introduced')
-  t.equal(fastURI.normalize('./a:b'), './a:b', 'first-segment colon is kept behind a "." segment (RFC 3986 section 4.2)')
-  t.equal(fastURI.parse(fastURI.normalize('./a:b')).scheme, undefined, 'no scheme is introduced')
-  t.end()
-})
-
-test('normalize keeps the existing behavior for root-relative and absolute paths', (t) => {
-  t.equal(fastURI.normalize('/a/../b'), '/b')
-  t.equal(fastURI.normalize('/../x'), '/x')
-  t.equal(fastURI.normalize('http://h/a/../../b'), 'http://h/b')
-  t.end()
-})
-
-test('equal does not alias relative references with different targets', (t) => {
-  t.equal(fastURI.equal('../x', 'x'), false)
-  t.equal(fastURI.equal('a/../b', '/b'), false)
-  t.equal(fastURI.equal('x/..', '/'), false)
-  t.equal(fastURI.equal('a/../b', 'b'), true)
-  t.end()
-})
-
-test('resolving a normalized relative reference matches resolving the original', (t) => {
-  for (const base of [...ABSOLUTE_BASES, ...RELATIVE_BASES]) {
-    for (const ref of ['a/../b', 'x/..', '../x', './../x', 'a/b/../../..', '.', '..', './/x']) {
-      t.equal(
-        fastURI.resolve(base, fastURI.normalize(ref)),
-        fastURI.resolve(base, ref),
-        `${base} + ${ref}`
-      )
-    }
-  }
-  t.equal(fastURI.resolve('http://h/p/q/r', fastURI.normalize('a/../b')), 'http://h/p/q/b')
-  t.equal(fastURI.resolve('http://h/p/q/r', fastURI.normalize('../x')), 'http://h/p/x')
-  t.end()
-})
-
-test('property: normalization of relative references is resolution-preserving and idempotent', (t) => {
-  const segments = ['a', 'b', '.', '..', '', 'a:b']
-  // Deterministic linear congruential generator so failures are reproducible.
-  let seed = 0x5ec02
-  const next = (n) => {
-    seed = (seed * 1103515245 + 12345) % 2147483648
-    return Math.floor((seed / 2147483648) * n)
-  }
-
-  let failures = 0
-  let checked = 0
-  for (let i = 0; i < 4000; i++) {
-    const length = 1 + next(6)
-    const parts = []
-    for (let j = 0; j < length; j++) parts.push(segments[next(segments.length)])
-    const ref = parts.join('/')
-    // Only relative-path references: empty refs, refs starting with "/", and
-    // refs whose first segment contains ":" are not affected by this change.
-    if (ref === '' || ref[0] === '/' || fastURI.parse(ref).scheme !== undefined) continue
-
-    checked++
-    const normalized = fastURI.normalize(ref)
-    if (fastURI.normalize(normalized) !== normalized) {
-      failures++
-      t.fail(`not idempotent: ${ref} -> ${normalized} -> ${fastURI.normalize(normalized)}`)
-    }
-    // 3.x's removeDotSegments (used by resolve) collapses a trailing "//" to
-    // "/" (fixed in v4 by #185), so resolve() itself is inconsistent for
-    // these paths regardless of normalization.
-    if (normalized.endsWith('//')) continue
-    for (const base of ABSOLUTE_BASES) {
-      const expected = fastURI.resolve(base, ref)
-      const actual = fastURI.resolve(base, normalized)
-      if (actual !== expected) {
-        failures++
-        t.fail(`${base} + ${ref}: normalized ${normalized} resolves to ${actual}, expected ${expected}`)
-      }
-    }
-  }
-
-  t.ok(checked > 1000, `checked ${checked} relative references`)
-  t.equal(failures, 0, 'no relative reference changed meaning')
-  t.end()
-})
-
-test('suffix normalization preserves relative path meaning', (t) => {
-  const options = { reference: 'suffix', scheme: 'x' }
-  for (const [input, expected] of [
-    ['a/../b', 'b'],
-    ['x/..', './'],
-    ['a/../a:b', './a:b']
-  ]) {
-    t.equal(fastURI.normalize(input, options), expected, `${input} -> ${expected}`)
-  }
-  t.end()
-})
-
-test('normalize does not promote a colon-first relative reference to a scheme (skipEscape)', (t) => {
-  // RFC 3986 section 4.2: a first path segment containing ":" must stay
-  // protected by a leading "./", or it is mistaken for a scheme. Collapsing
-  // the protecting dot segment must not expose the colon. The default path
-  // escapes the colon; with skipEscape the colon is emitted raw and the
-  // reference is reparsed as absolute (scheme "a"), changing its meaning.
-  const colonRefs = ['./a:b', 'a/../a:b']
-  for (const ref of colonRefs) {
-    const normalized = fastURI.normalize(ref, { skipEscape: true })
-    t.equal(
-      fastURI.parse(normalized).scheme,
-      undefined,
-      `${ref} -> ${normalized} must not introduce a scheme`
-    )
-    for (const base of ABSOLUTE_BASES) {
-      t.equal(
-        fastURI.resolve(base, normalized, { skipEscape: true }),
-        fastURI.resolve(base, ref, { skipEscape: true }),
-        `${base} + ${ref}: normalized ${normalized} must resolve the same`
-      )
-    }
-  }
-  t.end()
-})

package/node_modules/fast-uri/test/reserved-path-normalization.test.js

@@ -1,137 +0,0 @@
-'use strict'
-
-const test = require('tape')
-const fastURI = require('..')
-
-const PATH_RESERVED = "!$&'()*+,;=:@/"
-
-function percentEncode (character, lowerCase) {
-  const hex = character.charCodeAt(0).toString(16).padStart(2, '0')
-  return '%' + (lowerCase ? hex : hex.toUpperCase())
-}
-
-test('normalize preserves literal and escaped reserved path characters', (t) => {
-  t.equal(
-    fastURI.normalize('http://example.com/a;b'),
-    'http://example.com/a;b',
-    'literal semicolon remains literal'
-  )
-  t.equal(
-    fastURI.normalize('http://example.com/a%3ab'),
-    'http://example.com/a%3Ab',
-    'escaped colon remains escaped and its hex is uppercased'
-  )
-
-  for (const character of PATH_RESERVED) {
-    const literal = `http://example.com/a${character}b`
-    const escaped = `http://example.com/a${percentEncode(character, true)}b`
-    const normalizedEscape = `http://example.com/a${percentEncode(character, false)}b`
-
-    t.equal(fastURI.normalize(literal), literal, `preserves literal ${character}`)
-    t.equal(fastURI.normalize(escaped), normalizedEscape, `preserves escaped ${character}`)
-  }
-
-  t.equal(
-    fastURI.normalize('http://example.com/a/./café'),
-    'http://example.com/a/caf%C3%A9',
-    'removes real dot segments and UTF-8 encodes raw non-ASCII'
-  )
-  t.equal(
-    fastURI.normalize('http://example.com/a/%2e%2e/b'),
-    'http://example.com/a/%2E%2E/b',
-    'preserves escaped dots as path data'
-  )
-  t.equal(
-    fastURI.normalize('http://example.com/Kſ'),
-    'http://example.com/%E2%84%AA%C5%BF',
-    'UTF-8 encodes Unicode characters that case-fold to ASCII'
-  )
-  t.end()
-})
-
-test('serialize uses the RFC 3986 path character set without opening escapes', (t) => {
-  const rawPath = `/a${PATH_RESERVED}b`
-  t.equal(
-    fastURI.serialize({ scheme: 'http', host: 'example.com', path: rawPath }),
-    `http://example.com${rawPath}`,
-    'keeps all legal raw path characters'
-  )
-
-  const escapedPath = Array.from(PATH_RESERVED, (character) => percentEncode(character, true)).join('')
-  const normalizedEscapedPath = Array.from(PATH_RESERVED, (character) => percentEncode(character, false)).join('')
-  t.equal(
-    fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/' + escapedPath }),
-    'http://example.com/' + normalizedEscapedPath,
-    'uppercases valid escapes without decoding reserved characters'
-  )
-
-  t.equal(
-    fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/a?b#c[d]' }),
-    'http://example.com/a%3Fb%23c%5Bd%5D',
-    'encodes characters that would leave the path component'
-  )
-  t.equal(
-    fastURI.serialize({ path: 'a:b/c:d' }),
-    'a%3Ab/c:d',
-    'only escapes a colon where path-noscheme requires it'
-  )
-  t.equal(
-    fastURI.serialize({ path: './a:b/c:d' }),
-    './a:b/c:d',
-    'a first-segment colon exposed by dot-segment removal is kept behind a "." segment'
-  )
-  t.equal(
-    fastURI.normalize('./a:b'),
-    './a:b',
-    'normalization keeps a relative path from becoming a scheme without re-encoding the colon'
-  )
-  t.equal(
-    fastURI.serialize({ path: '/Kſ' }),
-    '/%E2%84%AA%C5%BF',
-    'UTF-8 encodes Unicode characters that case-fold to ASCII'
-  )
-  t.end()
-})
-
-test('equal distinguishes escaped reserved path data from literal syntax', (t) => {
-  for (const character of PATH_RESERVED) {
-    const literal = `http://example.com/a${character}b`
-    const escaped = `http://example.com/a${percentEncode(character, false)}b`
-    t.equal(fastURI.equal(literal, escaped, {}), false, `distinguishes literal and escaped ${character}`)
-  }
-
-  t.equal(
-    fastURI.equal('./a:b', 'a:b', {}),
-    false,
-    'does not equate a relative path with an absolute URI after removing dot segments'
-  )
-  t.end()
-})
-
-// A suffix reference never emits its scheme token, so it is a scheme-less
-// (path-noscheme) reference: a bare ':' in its first path segment must be
-// escaped, or the serialized output reparses as an absolute URI with a scheme.
-// @see https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp
-test('suffix reference escapes a first-segment colon instead of emitting a scheme', (t) => {
-  const dangerous = /^(?:javascript|data|vbscript):/i
-  const options = { reference: 'suffix', scheme: 'x' }
-
-  for (const input of ['javascript:alert(1)', '%6Aavascript:alert(1)', 'data:text/html,x', 'vbscript:msgbox(1)']) {
-    t.notOk(dangerous.test(fastURI.normalize(input, options)), `${input} normalizes to an inert reference`)
-  }
-
-  t.equal(
-    fastURI.normalize('javascript:alert(1)', options),
-    'javascript%3Aalert(1)',
-    'escapes the leading-segment colon to %3A'
-  )
-  t.notOk(
-    dangerous.test(fastURI.resolve('https://a.example/base/', '%6Aavascript:alert(1)', { reference: 'suffix' })),
-    'resolve in suffix mode does not emit a live scheme'
-  )
-
-  // legitimate suffix usage is unchanged
-  t.equal(fastURI.normalize('path/to/file', options), 'path/to/file', 'plain path unchanged')
-  t.equal(fastURI.normalize('a/b:c', options), 'a/b:c', 'colon in a later segment stays literal')
-  t.end()
-})

package/node_modules/fast-uri/test/resolve.test.js

@@ -1,87 +0,0 @@
-'use strict'
-
-const test = require('tape')
-const fastURI = require('..')
-
-test('URI Resolving', (t) => {
-  // normal examples from RFC 3986
-  const base = 'uri://a/b/c/d;p?q'
-  t.equal(fastURI.resolve(base, 'g:h'), 'g:h', 'g:h')
-  t.equal(fastURI.resolve(base, 'g:h'), 'g:h', 'g:h')
-  t.equal(fastURI.resolve(base, 'g'), 'uri://a/b/c/g', 'g')
-  t.equal(fastURI.resolve(base, './g'), 'uri://a/b/c/g', './g')
-  t.equal(fastURI.resolve(base, 'g/'), 'uri://a/b/c/g/', 'g/')
-  t.equal(fastURI.resolve(base, '/g'), 'uri://a/g', '/g')
-  t.equal(fastURI.resolve(base, '//g'), 'uri://g', '//g')
-  t.equal(fastURI.resolve(base, '?y'), 'uri://a/b/c/d;p?y', '?y')
-  t.equal(fastURI.resolve(base, 'g?y'), 'uri://a/b/c/g?y', 'g?y')
-  t.equal(fastURI.resolve(base, '#s'), 'uri://a/b/c/d;p?q#s', '#s')
-  t.equal(fastURI.resolve(base, 'g#s'), 'uri://a/b/c/g#s', 'g#s')
-  t.equal(fastURI.resolve(base, 'g?y#s'), 'uri://a/b/c/g?y#s', 'g?y#s')
-  t.equal(fastURI.resolve(base, ';x'), 'uri://a/b/c/;x', ';x')
-  t.equal(fastURI.resolve(base, 'g;x'), 'uri://a/b/c/g;x', 'g;x')
-  t.equal(fastURI.resolve(base, 'g;x?y#s'), 'uri://a/b/c/g;x?y#s', 'g;x?y#s')
-  t.equal(fastURI.resolve(base, ''), 'uri://a/b/c/d;p?q', '')
-  t.equal(fastURI.resolve(base, '.'), 'uri://a/b/c/', '.')
-  t.equal(fastURI.resolve(base, './'), 'uri://a/b/c/', './')
-  t.equal(fastURI.resolve(base, '..'), 'uri://a/b/', '..')
-  t.equal(fastURI.resolve(base, '../'), 'uri://a/b/', '../')
-  t.equal(fastURI.resolve(base, '../g'), 'uri://a/b/g', '../g')
-  t.equal(fastURI.resolve(base, '../..'), 'uri://a/', '../..')
-  t.equal(fastURI.resolve(base, '../../'), 'uri://a/', '../../')
-  t.equal(fastURI.resolve(base, '../../g'), 'uri://a/g', '../../g')
-
-  // abnormal examples from RFC 3986
-  t.equal(fastURI.resolve(base, '../../../g'), 'uri://a/g', '../../../g')
-  t.equal(fastURI.resolve(base, '../../../../g'), 'uri://a/g', '../../../../g')
-
-  t.equal(fastURI.resolve(base, '/./g'), 'uri://a/g', '/./g')
-  t.equal(fastURI.resolve(base, '/../g'), 'uri://a/g', '/../g')
-  t.equal(fastURI.resolve(base, 'g.'), 'uri://a/b/c/g.', 'g.')
-  t.equal(fastURI.resolve(base, '.g'), 'uri://a/b/c/.g', '.g')
-  t.equal(fastURI.resolve(base, 'g..'), 'uri://a/b/c/g..', 'g..')
-  t.equal(fastURI.resolve(base, '..g'), 'uri://a/b/c/..g', '..g')
-
-  t.equal(fastURI.resolve(base, './../g'), 'uri://a/b/g', './../g')
-  t.equal(fastURI.resolve(base, './g/.'), 'uri://a/b/c/g/', './g/.')
-  t.equal(fastURI.resolve(base, 'g/./h'), 'uri://a/b/c/g/h', 'g/./h')
-  t.equal(fastURI.resolve(base, 'g/../h'), 'uri://a/b/c/h', 'g/../h')
-  t.equal(fastURI.resolve(base, 'g;x=1/./y'), 'uri://a/b/c/g;x=1/y', 'g;x=1/./y')
-  t.equal(fastURI.resolve(base, 'g;x=1/../y'), 'uri://a/b/c/y', 'g;x=1/../y')
-
-  t.equal(fastURI.resolve(base, 'g?y/./x'), 'uri://a/b/c/g?y/./x', 'g?y/./x')
-  t.equal(fastURI.resolve(base, 'g?y/../x'), 'uri://a/b/c/g?y/../x', 'g?y/../x')
-  t.equal(fastURI.resolve(base, 'g#s/./x'), 'uri://a/b/c/g#s/./x', 'g#s/./x')
-  t.equal(fastURI.resolve(base, 'g#s/../x'), 'uri://a/b/c/g#s/../x', 'g#s/../x')
-
-  t.equal(fastURI.resolve(base, 'uri:g'), 'uri:g', 'uri:g')
-  t.equal(fastURI.resolve(base, 'uri:g', {}), 'uri:g', 'uri:g')
-  t.equal(fastURI.resolve(base, 'uri:g', { tolerant: undefined }), 'uri:g', 'uri:g')
-  t.equal(fastURI.resolve(base, 'uri:g', { tolerant: false }), 'uri:g', 'uri:g')
-  t.equal(fastURI.resolve(base, 'uri:g', { tolerant: true }), 'uri://a/b/c/g', 'uri:g')
-
-  // examples by PAEz
-  // example was provided to avoid infinite loop within regex
-  // this is not the case anymore
-  // t.equal(URI.resolve('//www.g.com/', '/adf\ngf'), '//www.g.com/adf%0Agf', '/adf\\ngf')
-  // t.equal(URI.resolve('//www.g.com/error\n/bleh/bleh', '..'), '//www.g.com/error%0A/', '//www.g.com/error\\n/bleh/bleh')
-  t.end()
-})
-
-test('URN Resolving', (t) => {
-  // example from epoberezkin
-  t.equal(fastURI.resolve('', 'urn:some:ip:prop'), 'urn:some:ip:prop', 'urn:some:ip:prop')
-  t.equal(fastURI.resolve('#', 'urn:some:ip:prop'), 'urn:some:ip:prop', 'urn:some:ip:prop')
-  t.equal(fastURI.resolve('urn:some:ip:prop', 'urn:some:ip:prop'), 'urn:some:ip:prop', 'urn:some:ip:prop')
-  t.equal(fastURI.resolve('urn:some:other:prop', 'urn:some:ip:prop'), 'urn:some:ip:prop', 'urn:some:ip:prop')
-  t.end()
-})
-
-test('URI Resolving tolerates malformed fragments', (t) => {
-  t.equal(
-    fastURI.resolve('http://base.com/', 'http://example.com/#%E0%A4A'),
-    'http://example.com/#%E0%A4A',
-    'malformed fragment does not throw during resolve'
-  )
-  t.end()
-})

package/node_modules/fast-uri/test/rfc-3986.test.js

@@ -1,90 +0,0 @@
-'use strict'
-
-const test = require('tape')
-const fastURI = require('..')
-
-test('RFC 3986', (t) => {
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/', secure: true }),
-    'http://example.com/', 'http://example.com/')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/foo', secure: true }),
-    'http://example.com/foo', 'http://example.com/foo')
-
-  // A.  If the input buffer begins with a prefix of "../" or "./",
-  //     then remove that prefix from the input buffer; otherwise,
-
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '../', secure: true }),
-    'http://example.com/', 'http://example.com/')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: './', secure: true }),
-    'http://example.com/', 'http://example.com/')
-
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '../../', secure: true }),
-    'http://example.com/', 'http://example.com/')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '././', secure: true }),
-    'http://example.com/', 'http://example.com/')
-
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: './../', secure: true }),
-    'http://example.com/', 'http://example.com/')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '.././', secure: true }),
-    'http://example.com/', 'http://example.com/')
-
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '../foo', secure: true }),
-    'http://example.com/foo', 'http://example.com/foo')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: './foo', secure: true }),
-    'http://example.com/foo', 'http://example.com/foo')
-
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '../../foo', secure: true }),
-    'http://example.com/foo', 'http://example.com/foo')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '././foo', secure: true }),
-    'http://example.com/foo', 'http://example.com/foo')
-
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: './../foo', secure: true }),
-    'http://example.com/foo', 'http://example.com/foo')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '.././foo', secure: true }),
-    'http://example.com/foo', 'http://example.com/foo')
-
-  // B.  if the input buffer begins with a prefix of "/./" or "/.",
-  //     where "." is a complete path segment, then replace that
-  //     prefix with "/" in the input buffer; otherwise,
-
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/./', secure: true }),
-    'http://example.com/', 'http://example.com/')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/.', secure: true }),
-    'http://example.com/', 'http://example.com/')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/./foo', secure: true }),
-    'http://example.com/foo', 'http://example.com/foo')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/.././foo', secure: true }),
-    'http://example.com/foo', 'http://example.com/foo')
-
-  // C.  if the input buffer begins with a prefix of "/../" or "/..",
-  //     where ".." is a complete path segment, then replace that
-  //     prefix with "/" in the input buffer and remove the last
-  //     segment and its preceding "/" (if any) from the output
-  //     buffer; otherwise,
-
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/../', secure: true }),
-    'http://example.com/', 'http://example.com/')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/..', secure: true }),
-    'http://example.com/', 'http://example.com/')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/../foo', secure: true }),
-    'http://example.com/foo', 'http://example.com/foo')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/foo/..', secure: true }),
-    'http://example.com/', 'http://example.com/')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/foo/bar/..', secure: true }),
-    'http://example.com/foo/', 'http://example.com/foo/')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/foo/../bar/..', secure: true }),
-    'http://example.com/', 'http://example.com/')
-
-  // D.  if the input buffer consists only of "." or "..", then remove
-  //     that from the input buffer; otherwise,
-
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/.', secure: true }),
-    'http://example.com/', 'http://example.com/')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/..', secure: true }),
-    'http://example.com/', 'http://example.com/')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '.', secure: true }),
-    'http://example.com/', 'http://example.com/')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '..', secure: true }),
-    'http://example.com/', 'http://example.com/')
-
-  t.end()
-})

package/node_modules/fast-uri/test/scheme-validation.test.js

@@ -1,163 +0,0 @@
-'use strict'
-
-const test = require('tape')
-const fastURI = require('..')
-
-const MALFORMED_SCHEME_ERROR = 'URI scheme is malformed.'
-
-const malformedSchemes = [
-  '%2f%2fevil.example:/pwn',
-  '%u002f%u002fevil.example:/pwn',
-  '%0d%0aSet-Cookie:%20sid=attacker:/p',
-  'foo%3Abar:value',
-  'foo%2Fbar:value',
-  '1http://example.com/',
-  'foo_bar:value',
-  'éxample:value',
-  'Kttp://example.com/',
-  'ſcheme:value',
-  // RFC 3986 section 3.1 does not allow percent-encoding in a scheme.
-  '%4Aavascript:alert(1)',
-  '%6aavascript:alert(1)',
-  'foo%2Bbar:value',
-  '%u006Aavascript:1',
-  'ht%74ps://example.com/',
-  'ma%69lto:user@example.org',
-  '%64ata:text/html,x'
-]
-
-test('parse validates the decoded scheme against RFC 3986', (t) => {
-  const validSchemes = [
-    ['a:value', 'a'],
-    ['HTTP://example.com/', 'http'],
-    ['a1+.-:value', 'a1+.-'],
-    ['foo+bar:value', 'foo+bar']
-  ]
-
-  for (const [uri, scheme] of validSchemes) {
-    const parsed = fastURI.parse(uri)
-    t.equal(parsed.error, undefined, uri)
-    t.equal(parsed.scheme, scheme, uri + ' scheme')
-  }
-
-  for (const uri of malformedSchemes) {
-    const parsed = fastURI.parse(uri)
-    t.equal(parsed.error, MALFORMED_SCHEME_ERROR, uri)
-  }
-  t.end()
-})
-
-test('percent-encoded schemes do not select scheme handlers', (t) => {
-  t.equal(
-    fastURI.normalize('ht%74ps://example.com:443'),
-    'ht%74ps://example.com:443',
-    'HTTP normalization does not run for an encoded scheme'
-  )
-
-  // 3.x has no mailto scheme handler (added in v4); use the ws handler to
-  // verify that a percent-encoded scheme does not select its scheme handler
-  const ws = fastURI.parse('w%73://example.com/a?b')
-  t.equal(ws.resourceName, undefined, 'ws parsing does not run for an encoded scheme')
-  t.equal(ws.error, MALFORMED_SCHEME_ERROR)
-  t.end()
-})
-
-test('normalization cannot synthesize a scheme from encoded input', (t) => {
-  const inputs = [
-    '%6Aavascript:alert(1)',
-    '%4A%41%56%41%53%43%52%49%50%54:alert(1)',
-    '%u006Aavascript:alert(1)',
-    'j%61vascript:alert(1)',
-    '%64ata:text/html,<script>alert(1)</script>',
-    'vb%73cript:msgbox(1)'
-  ]
-
-  for (const uri of inputs) {
-    const parsed = fastURI.parse(uri)
-    t.equal(parsed.error, MALFORMED_SCHEME_ERROR, uri + ' is malformed')
-    t.notOk(/^(?:javascript|data|vbscript):/i.test(String(parsed.scheme) + ':'), uri + ' parsed scheme is not decoded')
-    t.equal(fastURI.normalize(uri), uri, uri + ' normalizes to itself')
-    t.equal(fastURI.equal(uri, uri), false, uri + ' is not comparable')
-    t.throws(() => fastURI.resolve('https://example.com/app/', uri), /URI scheme is malformed\./, uri + ' is rejected by resolve')
-  }
-
-  t.equal(fastURI.equal('%68ttp://a/', 'http://a/'), false, 'encoded scheme does not alias a plain scheme')
-  t.end()
-})
-
-test('normalize preserves schemes that decode to invalid identifiers', (t) => {
-  for (const uri of malformedSchemes) {
-    t.equal(fastURI.normalize(uri), uri, uri)
-  }
-  t.end()
-})
-
-test('scheme normalization cannot introduce authority or control delimiters', (t) => {
-  const authority = '%2f%2fevil.example:/pwn'
-  const crlf = '%0d%0aSet-Cookie:%20sid=attacker:/p'
-
-  t.equal(fastURI.parse(authority).host, undefined, 'original input has no authority')
-  t.equal(fastURI.normalize(authority), authority, 'normalization does not create an authority')
-  t.equal(fastURI.normalize(crlf), crlf, 'normalization does not emit raw CRLF')
-  t.equal(fastURI.normalize(crlf).includes('\r\n'), false, 'normalized output contains no raw CRLF')
-  t.end()
-})
-
-test('equal returns false for malformed decoded schemes', (t) => {
-  for (const uri of malformedSchemes) {
-    t.equal(fastURI.equal(uri, uri, {}), false, uri)
-  }
-  t.end()
-})
-
-test('resolve rejects malformed decoded schemes in either input', (t) => {
-  t.throws(
-    () => fastURI.resolve('%2f%2fevil.example:/base', 'child'),
-    /URI scheme is malformed\./,
-    'malformed base'
-  )
-  t.throws(
-    () => fastURI.resolve('https://allowed.example/app/', '%2f%2fevil.example:/pwn'),
-    /URI scheme is malformed\./,
-    'malformed relative reference'
-  )
-  t.end()
-})
-
-test('serialize validates component schemes without decoding them', (t) => {
-  t.equal(
-    fastURI.serialize({ scheme: 'foo+bar', path: 'value' }),
-    'foo+bar:value',
-    'valid scheme is serialized'
-  )
-  t.throws(
-    () => fastURI.serialize({ scheme: 'foo%2Bbar', path: 'value' }),
-    /URI scheme is malformed\./,
-    'percent-encoded scheme is rejected'
-  )
-  t.throws(
-    () => fastURI.serialize({ scheme: '%6Aavascript', path: 'alert(1)' }),
-    /URI scheme is malformed\./,
-    'encoded scheme cannot serialize as javascript:'
-  )
-  t.throws(
-    () => fastURI.serialize({ scheme: '//evil.example', path: '/pwn' }),
-    /URI scheme is malformed\./,
-    'raw invalid scheme'
-  )
-  t.throws(
-    () => fastURI.serialize({ scheme: '%2f%2fevil.example', path: '/pwn' }),
-    /URI scheme is malformed\./,
-    'encoded invalid scheme'
-  )
-  t.equal(
-    fastURI.equal(
-      { scheme: '%2f%2fevil.example', path: '/pwn' },
-      { scheme: '%2f%2fevil.example', path: '/pwn' },
-      {}
-    ),
-    false,
-    'equality fails closed for malformed component objects'
-  )
-  t.end()
-})