@tiangong-lca/pcr 0.0.0-stage → 0.1.2

package/node_modules/fast-uri/test/reserved-path-normalization.test.js

@@ -0,0 +1,109 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+const PATH_RESERVED = "!$&'()*+,;=:@/"
+
+function percentEncode (character, lowerCase) {
+  const hex = character.charCodeAt(0).toString(16).padStart(2, '0')
+  return '%' + (lowerCase ? hex : hex.toUpperCase())
+}
+
+test('normalize preserves literal and escaped reserved path characters', (t) => {
+  t.equal(
+    fastURI.normalize('http://example.com/a;b'),
+    'http://example.com/a;b',
+    'literal semicolon remains literal'
+  )
+  t.equal(
+    fastURI.normalize('http://example.com/a%3ab'),
+    'http://example.com/a%3Ab',
+    'escaped colon remains escaped and its hex is uppercased'
+  )
+
+  for (const character of PATH_RESERVED) {
+    const literal = `http://example.com/a${character}b`
+    const escaped = `http://example.com/a${percentEncode(character, true)}b`
+    const normalizedEscape = `http://example.com/a${percentEncode(character, false)}b`
+
+    t.equal(fastURI.normalize(literal), literal, `preserves literal ${character}`)
+    t.equal(fastURI.normalize(escaped), normalizedEscape, `preserves escaped ${character}`)
+  }
+
+  t.equal(
+    fastURI.normalize('http://example.com/a/./café'),
+    'http://example.com/a/caf%C3%A9',
+    'removes real dot segments and UTF-8 encodes raw non-ASCII'
+  )
+  t.equal(
+    fastURI.normalize('http://example.com/a/%2e%2e/b'),
+    'http://example.com/a/%2E%2E/b',
+    'preserves escaped dots as path data'
+  )
+  t.equal(
+    fastURI.normalize('http://example.com/Kſ'),
+    'http://example.com/%E2%84%AA%C5%BF',
+    'UTF-8 encodes Unicode characters that case-fold to ASCII'
+  )
+  t.end()
+})
+
+test('serialize uses the RFC 3986 path character set without opening escapes', (t) => {
+  const rawPath = `/a${PATH_RESERVED}b`
+  t.equal(
+    fastURI.serialize({ scheme: 'http', host: 'example.com', path: rawPath }),
+    `http://example.com${rawPath}`,
+    'keeps all legal raw path characters'
+  )
+
+  const escapedPath = Array.from(PATH_RESERVED, (character) => percentEncode(character, true)).join('')
+  const normalizedEscapedPath = Array.from(PATH_RESERVED, (character) => percentEncode(character, false)).join('')
+  t.equal(
+    fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/' + escapedPath }),
+    'http://example.com/' + normalizedEscapedPath,
+    'uppercases valid escapes without decoding reserved characters'
+  )
+
+  t.equal(
+    fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/a?b#c[d]' }),
+    'http://example.com/a%3Fb%23c%5Bd%5D',
+    'encodes characters that would leave the path component'
+  )
+  t.equal(
+    fastURI.serialize({ path: 'a:b/c:d' }),
+    'a%3Ab/c:d',
+    'only escapes a colon where path-noscheme requires it'
+  )
+  t.equal(
+    fastURI.serialize({ path: './a:b/c:d' }),
+    'a%3Ab/c:d',
+    'escapes a first-segment colon exposed by dot-segment removal'
+  )
+  t.equal(
+    fastURI.normalize('./a:b'),
+    'a%3Ab',
+    'normalization keeps a relative path from becoming a scheme'
+  )
+  t.equal(
+    fastURI.serialize({ path: '/Kſ' }),
+    '/%E2%84%AA%C5%BF',
+    'UTF-8 encodes Unicode characters that case-fold to ASCII'
+  )
+  t.end()
+})
+
+test('equal distinguishes escaped reserved path data from literal syntax', (t) => {
+  for (const character of PATH_RESERVED) {
+    const literal = `http://example.com/a${character}b`
+    const escaped = `http://example.com/a${percentEncode(character, false)}b`
+    t.equal(fastURI.equal(literal, escaped, {}), false, `distinguishes literal and escaped ${character}`)
+  }
+
+  t.equal(
+    fastURI.equal('./a:b', 'a:b', {}),
+    false,
+    'does not equate a relative path with an absolute URI after removing dot segments'
+  )
+  t.end()
+})

package/node_modules/fast-uri/test/resolve.test.js

@@ -0,0 +1,87 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+test('URI Resolving', (t) => {
+  // normal examples from RFC 3986
+  const base = 'uri://a/b/c/d;p?q'
+  t.equal(fastURI.resolve(base, 'g:h'), 'g:h', 'g:h')
+  t.equal(fastURI.resolve(base, 'g:h'), 'g:h', 'g:h')
+  t.equal(fastURI.resolve(base, 'g'), 'uri://a/b/c/g', 'g')
+  t.equal(fastURI.resolve(base, './g'), 'uri://a/b/c/g', './g')
+  t.equal(fastURI.resolve(base, 'g/'), 'uri://a/b/c/g/', 'g/')
+  t.equal(fastURI.resolve(base, '/g'), 'uri://a/g', '/g')
+  t.equal(fastURI.resolve(base, '//g'), 'uri://g', '//g')
+  t.equal(fastURI.resolve(base, '?y'), 'uri://a/b/c/d;p?y', '?y')
+  t.equal(fastURI.resolve(base, 'g?y'), 'uri://a/b/c/g?y', 'g?y')
+  t.equal(fastURI.resolve(base, '#s'), 'uri://a/b/c/d;p?q#s', '#s')
+  t.equal(fastURI.resolve(base, 'g#s'), 'uri://a/b/c/g#s', 'g#s')
+  t.equal(fastURI.resolve(base, 'g?y#s'), 'uri://a/b/c/g?y#s', 'g?y#s')
+  t.equal(fastURI.resolve(base, ';x'), 'uri://a/b/c/;x', ';x')
+  t.equal(fastURI.resolve(base, 'g;x'), 'uri://a/b/c/g;x', 'g;x')
+  t.equal(fastURI.resolve(base, 'g;x?y#s'), 'uri://a/b/c/g;x?y#s', 'g;x?y#s')
+  t.equal(fastURI.resolve(base, ''), 'uri://a/b/c/d;p?q', '')
+  t.equal(fastURI.resolve(base, '.'), 'uri://a/b/c/', '.')
+  t.equal(fastURI.resolve(base, './'), 'uri://a/b/c/', './')
+  t.equal(fastURI.resolve(base, '..'), 'uri://a/b/', '..')
+  t.equal(fastURI.resolve(base, '../'), 'uri://a/b/', '../')
+  t.equal(fastURI.resolve(base, '../g'), 'uri://a/b/g', '../g')
+  t.equal(fastURI.resolve(base, '../..'), 'uri://a/', '../..')
+  t.equal(fastURI.resolve(base, '../../'), 'uri://a/', '../../')
+  t.equal(fastURI.resolve(base, '../../g'), 'uri://a/g', '../../g')
+
+  // abnormal examples from RFC 3986
+  t.equal(fastURI.resolve(base, '../../../g'), 'uri://a/g', '../../../g')
+  t.equal(fastURI.resolve(base, '../../../../g'), 'uri://a/g', '../../../../g')
+
+  t.equal(fastURI.resolve(base, '/./g'), 'uri://a/g', '/./g')
+  t.equal(fastURI.resolve(base, '/../g'), 'uri://a/g', '/../g')
+  t.equal(fastURI.resolve(base, 'g.'), 'uri://a/b/c/g.', 'g.')
+  t.equal(fastURI.resolve(base, '.g'), 'uri://a/b/c/.g', '.g')
+  t.equal(fastURI.resolve(base, 'g..'), 'uri://a/b/c/g..', 'g..')
+  t.equal(fastURI.resolve(base, '..g'), 'uri://a/b/c/..g', '..g')
+
+  t.equal(fastURI.resolve(base, './../g'), 'uri://a/b/g', './../g')
+  t.equal(fastURI.resolve(base, './g/.'), 'uri://a/b/c/g/', './g/.')
+  t.equal(fastURI.resolve(base, 'g/./h'), 'uri://a/b/c/g/h', 'g/./h')
+  t.equal(fastURI.resolve(base, 'g/../h'), 'uri://a/b/c/h', 'g/../h')
+  t.equal(fastURI.resolve(base, 'g;x=1/./y'), 'uri://a/b/c/g;x=1/y', 'g;x=1/./y')
+  t.equal(fastURI.resolve(base, 'g;x=1/../y'), 'uri://a/b/c/y', 'g;x=1/../y')
+
+  t.equal(fastURI.resolve(base, 'g?y/./x'), 'uri://a/b/c/g?y/./x', 'g?y/./x')
+  t.equal(fastURI.resolve(base, 'g?y/../x'), 'uri://a/b/c/g?y/../x', 'g?y/../x')
+  t.equal(fastURI.resolve(base, 'g#s/./x'), 'uri://a/b/c/g#s/./x', 'g#s/./x')
+  t.equal(fastURI.resolve(base, 'g#s/../x'), 'uri://a/b/c/g#s/../x', 'g#s/../x')
+
+  t.equal(fastURI.resolve(base, 'uri:g'), 'uri:g', 'uri:g')
+  t.equal(fastURI.resolve(base, 'uri:g', {}), 'uri:g', 'uri:g')
+  t.equal(fastURI.resolve(base, 'uri:g', { tolerant: undefined }), 'uri:g', 'uri:g')
+  t.equal(fastURI.resolve(base, 'uri:g', { tolerant: false }), 'uri:g', 'uri:g')
+  t.equal(fastURI.resolve(base, 'uri:g', { tolerant: true }), 'uri://a/b/c/g', 'uri:g')
+
+  // examples by PAEz
+  // example was provided to avoid infinite loop within regex
+  // this is not the case anymore
+  // t.equal(URI.resolve('//www.g.com/', '/adf\ngf'), '//www.g.com/adf%0Agf', '/adf\\ngf')
+  // t.equal(URI.resolve('//www.g.com/error\n/bleh/bleh', '..'), '//www.g.com/error%0A/', '//www.g.com/error\\n/bleh/bleh')
+  t.end()
+})
+
+test('URN Resolving', (t) => {
+  // example from epoberezkin
+  t.equal(fastURI.resolve('', 'urn:some:ip:prop'), 'urn:some:ip:prop', 'urn:some:ip:prop')
+  t.equal(fastURI.resolve('#', 'urn:some:ip:prop'), 'urn:some:ip:prop', 'urn:some:ip:prop')
+  t.equal(fastURI.resolve('urn:some:ip:prop', 'urn:some:ip:prop'), 'urn:some:ip:prop', 'urn:some:ip:prop')
+  t.equal(fastURI.resolve('urn:some:other:prop', 'urn:some:ip:prop'), 'urn:some:ip:prop', 'urn:some:ip:prop')
+  t.end()
+})
+
+test('URI Resolving tolerates malformed fragments', (t) => {
+  t.equal(
+    fastURI.resolve('http://base.com/', 'http://example.com/#%E0%A4A'),
+    'http://example.com/#%E0%A4A',
+    'malformed fragment does not throw during resolve'
+  )
+  t.end()
+})

package/node_modules/fast-uri/test/rfc-3986.test.js

@@ -0,0 +1,90 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+test('RFC 3986', (t) => {
+  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/', secure: true }),
+    'http://example.com/', 'http://example.com/')
+  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/foo', secure: true }),
+    'http://example.com/foo', 'http://example.com/foo')
+
+  // A.  If the input buffer begins with a prefix of "../" or "./",
+  //     then remove that prefix from the input buffer; otherwise,
+
+  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '../', secure: true }),
+    'http://example.com/', 'http://example.com/')
+  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: './', secure: true }),
+    'http://example.com/', 'http://example.com/')
+
+  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '../../', secure: true }),
+    'http://example.com/', 'http://example.com/')
+  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '././', secure: true }),
+    'http://example.com/', 'http://example.com/')
+
+  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: './../', secure: true }),
+    'http://example.com/', 'http://example.com/')
+  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '.././', secure: true }),
+    'http://example.com/', 'http://example.com/')
+
+  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '../foo', secure: true }),
+    'http://example.com/foo', 'http://example.com/foo')
+  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: './foo', secure: true }),
+    'http://example.com/foo', 'http://example.com/foo')
+
+  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '../../foo', secure: true }),
+    'http://example.com/foo', 'http://example.com/foo')
+  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '././foo', secure: true }),
+    'http://example.com/foo', 'http://example.com/foo')
+
+  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: './../foo', secure: true }),
+    'http://example.com/foo', 'http://example.com/foo')
+  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '.././foo', secure: true }),
+    'http://example.com/foo', 'http://example.com/foo')
+
+  // B.  if the input buffer begins with a prefix of "/./" or "/.",
+  //     where "." is a complete path segment, then replace that
+  //     prefix with "/" in the input buffer; otherwise,
+
+  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/./', secure: true }),
+    'http://example.com/', 'http://example.com/')
+  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/.', secure: true }),
+    'http://example.com/', 'http://example.com/')
+  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/./foo', secure: true }),
+    'http://example.com/foo', 'http://example.com/foo')
+  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/.././foo', secure: true }),
+    'http://example.com/foo', 'http://example.com/foo')
+
+  // C.  if the input buffer begins with a prefix of "/../" or "/..",
+  //     where ".." is a complete path segment, then replace that
+  //     prefix with "/" in the input buffer and remove the last
+  //     segment and its preceding "/" (if any) from the output
+  //     buffer; otherwise,
+
+  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/../', secure: true }),
+    'http://example.com/', 'http://example.com/')
+  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/..', secure: true }),
+    'http://example.com/', 'http://example.com/')
+  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/../foo', secure: true }),
+    'http://example.com/foo', 'http://example.com/foo')
+  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/foo/..', secure: true }),
+    'http://example.com/', 'http://example.com/')
+  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/foo/bar/..', secure: true }),
+    'http://example.com/foo/', 'http://example.com/foo/')
+  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/foo/../bar/..', secure: true }),
+    'http://example.com/', 'http://example.com/')
+
+  // D.  if the input buffer consists only of "." or "..", then remove
+  //     that from the input buffer; otherwise,
+
+  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/.', secure: true }),
+    'http://example.com/', 'http://example.com/')
+  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/..', secure: true }),
+    'http://example.com/', 'http://example.com/')
+  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '.', secure: true }),
+    'http://example.com/', 'http://example.com/')
+  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '..', secure: true }),
+    'http://example.com/', 'http://example.com/')
+
+  t.end()
+})

package/node_modules/fast-uri/test/scheme-validation.test.js

@@ -0,0 +1,124 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+const MALFORMED_SCHEME_ERROR = 'URI scheme is malformed.'
+
+const malformedSchemes = [
+  '%2f%2fevil.example:/pwn',
+  '%u002f%u002fevil.example:/pwn',
+  '%0d%0aSet-Cookie:%20sid=attacker:/p',
+  'foo%3Abar:value',
+  'foo%2Fbar:value',
+  '1http://example.com/',
+  'foo_bar:value',
+  'éxample:value',
+  'Kttp://example.com/',
+  'ſcheme:value'
+]
+
+test('parse validates the decoded scheme against RFC 3986', (t) => {
+  const validSchemes = [
+    ['a:value', 'a'],
+    ['HTTP://example.com/', 'http'],
+    ['a1+.-:value', 'a1+.-'],
+    ['%4Aavascript:alert(1)', 'javascript'],
+    ['foo%2Bbar:value', 'foo+bar'],
+    ['%u006Aavascript:1', 'javascript'],
+    ['ht%74ps://example.com/', 'https']
+  ]
+
+  for (const [uri, scheme] of validSchemes) {
+    const parsed = fastURI.parse(uri)
+    t.equal(parsed.error, undefined, uri)
+    t.equal(parsed.scheme, scheme, uri + ' scheme')
+  }
+
+  for (const uri of malformedSchemes) {
+    const parsed = fastURI.parse(uri)
+    t.equal(parsed.error, MALFORMED_SCHEME_ERROR, uri)
+  }
+  t.end()
+})
+
+test('decoded schemes select their scheme handlers', (t) => {
+  t.equal(
+    fastURI.normalize('ht%74ps://example.com:443'),
+    'https://example.com/',
+    'HTTP normalization runs after decoding the scheme'
+  )
+
+  // 3.x has no mailto scheme handler (added in v4); use the ws handler to
+  // verify that a percent-encoded scheme still selects its scheme handler
+  const ws = fastURI.parse('we%62socket://example.com/')
+  t.equal(ws.scheme, 'websocket', 'ws parsing runs after decoding the scheme')
+  t.end()
+})
+
+test('normalize preserves schemes that decode to invalid identifiers', (t) => {
+  for (const uri of malformedSchemes) {
+    t.equal(fastURI.normalize(uri), uri, uri)
+  }
+  t.end()
+})
+
+test('scheme normalization cannot introduce authority or control delimiters', (t) => {
+  const authority = '%2f%2fevil.example:/pwn'
+  const crlf = '%0d%0aSet-Cookie:%20sid=attacker:/p'
+
+  t.equal(fastURI.parse(authority).host, undefined, 'original input has no authority')
+  t.equal(fastURI.normalize(authority), authority, 'normalization does not create an authority')
+  t.equal(fastURI.normalize(crlf), crlf, 'normalization does not emit raw CRLF')
+  t.equal(fastURI.normalize(crlf).includes('\r\n'), false, 'normalized output contains no raw CRLF')
+  t.end()
+})
+
+test('equal returns false for malformed decoded schemes', (t) => {
+  for (const uri of malformedSchemes) {
+    t.equal(fastURI.equal(uri, uri, {}), false, uri)
+  }
+  t.end()
+})
+
+test('resolve rejects malformed decoded schemes in either input', (t) => {
+  t.throws(
+    () => fastURI.resolve('%2f%2fevil.example:/base', 'child'),
+    /URI scheme is malformed\./,
+    'malformed base'
+  )
+  t.throws(
+    () => fastURI.resolve('https://allowed.example/app/', '%2f%2fevil.example:/pwn'),
+    /URI scheme is malformed\./,
+    'malformed relative reference'
+  )
+  t.end()
+})
+
+test('serialize validates decoded component schemes', (t) => {
+  t.equal(
+    fastURI.serialize({ scheme: 'foo%2Bbar', path: 'value' }),
+    'foo+bar:value',
+    'valid decoded scheme is serialized'
+  )
+  t.throws(
+    () => fastURI.serialize({ scheme: '//evil.example', path: '/pwn' }),
+    /URI scheme is malformed\./,
+    'raw invalid scheme'
+  )
+  t.throws(
+    () => fastURI.serialize({ scheme: '%2f%2fevil.example', path: '/pwn' }),
+    /URI scheme is malformed\./,
+    'encoded invalid scheme'
+  )
+  t.equal(
+    fastURI.equal(
+      { scheme: '%2f%2fevil.example', path: '/pwn' },
+      { scheme: '%2f%2fevil.example', path: '/pwn' },
+      {}
+    ),
+    false,
+    'equality fails closed for malformed component objects'
+  )
+  t.end()
+})

package/node_modules/fast-uri/test/security-normalization.test.js

@@ -0,0 +1,140 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+test('parse preserves reserved path escapes as data', (t) => {
+  const components = fastURI.parse('http://example.com/a%2Fb/public/%2e%2e/admin')
+
+  t.equal(components.path, '/a%2Fb/public/%2E%2E/admin')
+  t.end()
+})
+
+test('normalize preserves percent-encoded path separators and dot segments', (t) => {
+  t.equal(
+    fastURI.normalize('http://example.com/public/%2e%2e/admin'),
+    'http://example.com/public/%2E%2E/admin'
+  )
+
+  t.equal(
+    fastURI.normalize('http://example.com/a%2Fb'),
+    'http://example.com/a%2Fb'
+  )
+
+  t.end()
+})
+
+test('equal does not treat reserved path escapes as live path syntax', (t) => {
+  t.equal(
+    fastURI.equal('http://example.com/public/%2e%2e/admin', 'http://example.com/admin', {}),
+    false
+  )
+
+  t.equal(
+    fastURI.equal('http://example.com/a%2Fb', 'http://example.com/a/b', {}),
+    false
+  )
+
+  t.end()
+})
+
+test('serialize preserves literal RFC 3986 reserved path characters', (t) => {
+  // GHSA-7mh8-fcmq-x23c: literal reserved path chars must not be rewritten to
+  // percent escapes by the escape()-style safe set.
+  const cases = [
+    'http://example.com/a;b',
+    'http://example.com/a=b',
+    'http://example.com/a&b',
+    'http://example.com/a$b',
+    'http://example.com/a:b',
+    'http://example.com/a@b'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((uri) => {
+    t.equal(fastURI.serialize(fastURI.parse(uri)), uri, uri)
+  })
+  t.end()
+})
+
+test('serialize preserves existing reserved path escapes as data', (t) => {
+  // GHSA-7mh8-fcmq-x23c: an existing %3A escape must stay %3A instead of being
+  // rewritten into a live colon.
+  const cases = [
+    'http://example.com/a%3Ab',
+    'http://example.com/a%3Bb',
+    'http://example.com/a%3D%3D'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((uri) => {
+    t.equal(fastURI.serialize(fastURI.parse(uri)), uri, uri)
+  })
+  t.end()
+})
+
+test('serialize keeps path-noscheme colon escaping', (t) => {
+  // Without a scheme a literal colon would be reparsed as a scheme separator,
+  // so it must stay percent-escaped while an existing %3A is preserved.
+  t.equal(fastURI.serialize({ path: 'foo:bar' }), 'foo%3Abar')
+  t.equal(fastURI.serialize({ path: 'a%3Ab' }), 'a%3Ab')
+  t.end()
+})
+
+test('hostname normalization never decodes an escape more than once', (t) => {
+  const encodedLocalhost = 'http://%256c%256f%2563%2561%256c%2568%256f%2573%2574/'
+  const encodedLoopback = '//127%252e0%252e0%252e1/private'
+  const encodedMetadataAddress = '//169%252E254%252E169%252E254/latest/meta-data/'
+
+  t.equal(fastURI.normalize(encodedLocalhost), encodedLocalhost, 'nested hostname letters remain encoded')
+  t.equal(fastURI.normalize(encodedLoopback), encodedLoopback, 'nested IPv4 dots remain encoded')
+  t.equal(
+    fastURI.resolve('https://safe.example/', encodedLoopback),
+    'https://127%252e0%252e0%252e1/private',
+    'resolve does not turn nested dots into a loopback address'
+  )
+  t.equal(
+    fastURI.resolve('https://allowed.com/api/v1/', encodedMetadataAddress),
+    'https://169%252e254%252e169%252e254/latest/meta-data/',
+    'resolve does not turn nested dots into a metadata address'
+  )
+  t.equal(
+    fastURI.normalize('http://allowed.com%255Cevil.com/'),
+    'http://allowed.com%255Cevil.com/',
+    'normalize does not activate a nested backslash'
+  )
+  t.equal(
+    fastURI.serialize({ scheme: 'http', host: '%256cocalhost', path: '/' }),
+    'http://%256cocalhost/',
+    'component serialization preserves an encoded percent sign'
+  )
+  t.equal(
+    fastURI.equal(encodedLocalhost, 'http://localhost/', {}),
+    false,
+    'nested escapes do not compare equal to their twice-decoded target'
+  )
+  t.end()
+})
+
+test('hostname normalization decodes only current unreserved escapes', (t) => {
+  t.equal(fastURI.normalize('x://%6cocalhost/'), 'x://localhost/', 'a current unreserved escape is decoded')
+  t.equal(fastURI.normalize('x://%256cocalhost/'), 'x://%256cocalhost/', 'an encoded percent is preserved')
+  t.equal(fastURI.normalize('x://host%2540evil/'), 'x://host%2540evil/', 'a nested authority delimiter stays inert')
+  t.equal(fastURI.normalize('x://%2525/'), 'x://%2525/', 'nested encoded percent signs stay encoded')
+  t.end()
+})
+
+test('host conversion failures are not treated as comparable URLs', (t) => {
+  const malformedHost = 'http://trusted.test%2540evil.test/'
+
+  t.equal(fastURI.normalize(malformedHost), malformedHost, 'normalization preserves the failing input')
+  t.equal(fastURI.equal(malformedHost, malformedHost, {}), false, 'equal rejects a failed host conversion')
+  t.throws(
+    () => fastURI.resolve(malformedHost, 'child', { domainHost: true }),
+    /Host's domain name can not be converted to ASCII/,
+    'resolve propagates a host conversion failure'
+  )
+  t.end()
+})