bare-url 2.5.0 → 2.5.2

package/binding.c

@@ -8,8 +8,91 @@
 #include <utf.h>
 #include <utf/string.h>
 
+// Maximum length, in bytes, of a UTF-8 string that is read into a stack buffer.
+// Longer strings fall back to a heap allocation. This covers the vast majority
+// of URLs without touching the heap.
+#define BARE_URL_STACK_STRING_MAX 1024
+
+// The UTF-8 encoding of a JavaScript string, together with whatever backs it.
+typedef struct {
+  const utf8_t *data;
+  size_t len;
+
+  js_string_view_t *view;
+  utf8_t *heap;
+} bare_url_string_t;
+
+// Exposes `value` as UTF-8. Strings that are stored as ASCII, which is nearly
+// all of them, are borrowed directly from the engine without being copied.
+// Anything else is transcoded into `stack`, or into a freshly allocated heap
+// buffer when it does not fit. The result must be released with
+// bare_url__free_string().
+static inline void
+bare_url__read_string(js_env_t *env, js_value_t *value, utf8_t *stack, size_t stack_len, bare_url_string_t *result) {
+  int err;
+
+  js_string_encoding_t encoding;
+  const void *data;
+  size_t len;
+
+  err = js_get_string_view(env, value, &encoding, &data, &len, &result->view);
+  assert(err == 0);
+
+  result->heap = NULL;
+
+  size_t utf8_len;
+
+  if (encoding == js_utf8) {
+    result->data = (const utf8_t *) data;
+    result->len = len;
+
+    return;
+  }
+
+  if (encoding == js_latin1) {
+    utf8_len = utf8_length_from_latin1((const latin1_t *) data, len);
+
+    // A Latin-1 string that is no longer as UTF-8 contains only ASCII, whose
+    // Latin-1 and UTF-8 encodings are identical.
+    if (utf8_len == len) {
+      result->data = (const utf8_t *) data;
+      result->len = len;
+
+      return;
+    }
+  } else {
+    assert(encoding == js_utf16le);
+
+    utf8_len = utf8_length_from_utf16le((const utf16_t *) data, len);
+  }
+
+  utf8_t *buffer = utf8_len <= stack_len ? stack : (result->heap = malloc(utf8_len));
+
+  if (encoding == js_latin1) {
+    latin1_convert_to_utf8((const latin1_t *) data, len, buffer);
+  } else {
+    utf16le_convert_to_utf8((const utf16_t *) data, len, buffer);
+  }
+
+  result->data = buffer;
+  result->len = utf8_len;
+}
+
+// Releases a string read with bare_url__read_string(), freeing its buffer only
+// when it was heap allocated rather than borrowed or written to the caller's
+// stack buffer.
+static inline void
+bare_url__free_string(js_env_t *env, bare_url_string_t *string) {
+  int err;
+
+  free(string->heap);
+
+  err = js_release_string_view(env, string->view);
+  assert(err == 0);
+}
+
 static js_value_t *
-bare_url_parse (js_env_t *env, js_callback_info_t *info) {
+bare_url_parse(js_env_t *env, js_callback_info_t *info) {
   int err;
 
   size_t argc = 4;
@@ -32,17 +115,14 @@ bare_url_parse (js_env_t *env, js_callback_info_t *info) {
   url_init(&base);
 
   if (has_base) {
-    size_t len;
-    err = js_get_value_string_utf8(env, argv[1], NULL, 0, &len);
-    assert(err == 0);
+    utf8_t stack[BARE_URL_STACK_STRING_MAX];
 
-    utf8_t *input = malloc(len);
-    err = js_get_value_string_utf8(env, argv[1], input, len, NULL);
-    assert(err == 0);
+    bare_url_string_t input;
+    bare_url__read_string(env, argv[1], stack, sizeof(stack), &input);
 
-    err = url_parse(&base, input, len, NULL);
+    err = url_parse(&base, input.data, input.len, NULL);
 
-    free(input);
+    bare_url__free_string(env, &input);
 
     if (err < 0) {
       url_destroy(&base);
@@ -53,22 +133,17 @@ bare_url_parse (js_env_t *env, js_callback_info_t *info) {
     }
   }
 
-  size_t len;
-  err = js_get_value_string_utf8(env, argv[0], NULL, 0, &len);
-  assert(err == 0);
+  utf8_t stack[BARE_URL_STACK_STRING_MAX];
 
-  utf8_t *input = malloc(len);
-  err = js_get_value_string_utf8(env, argv[0], input, len, NULL);
-  assert(err == 0);
-
-  js_value_t *handle;
+  bare_url_string_t input;
+  bare_url__read_string(env, argv[0], stack, sizeof(stack), &input);
 
   url_t url;
   url_init(&url);
 
-  err = url_parse(&url, input, len, has_base ? &base : NULL);
+  err = url_parse(&url, input.data, input.len, has_base ? &base : NULL);
 
-  free(input);
+  bare_url__free_string(env, &input);
 
   if (err < 0) {
     url_destroy(&base);
@@ -80,7 +155,7 @@ bare_url_parse (js_env_t *env, js_callback_info_t *info) {
   }
 
   js_value_t *href;
-  err = js_create_string_utf8(env, url.href.data, url.href.len, &href);
+  err = js_create_string_latin1(env, (const latin1_t *) url.href.data, url.href.len, &href);
   assert(err == 0);
 
   uint32_t *components;
@@ -96,7 +171,7 @@ bare_url_parse (js_env_t *env, js_callback_info_t *info) {
 }
 
 static js_value_t *
-bare_url_can_parse (js_env_t *env, js_callback_info_t *info) {
+bare_url_can_parse(js_env_t *env, js_callback_info_t *info) {
   int err;
 
   size_t argc = 2;
@@ -115,17 +190,14 @@ bare_url_can_parse (js_env_t *env, js_callback_info_t *info) {
   url_init(&base);
 
   if (has_base) {
-    size_t len;
-    err = js_get_value_string_utf8(env, argv[1], NULL, 0, &len);
-    assert(err == 0);
+    utf8_t stack[BARE_URL_STACK_STRING_MAX];
 
-    utf8_t *input = malloc(len);
-    err = js_get_value_string_utf8(env, argv[1], input, len, NULL);
-    assert(err == 0);
+    bare_url_string_t input;
+    bare_url__read_string(env, argv[1], stack, sizeof(stack), &input);
 
-    err = url_parse(&base, input, len, NULL);
+    err = url_parse(&base, input.data, input.len, NULL);
 
-    free(input);
+    bare_url__free_string(env, &input);
 
     if (err < 0) {
       url_destroy(&base);
@@ -138,20 +210,17 @@ bare_url_can_parse (js_env_t *env, js_callback_info_t *info) {
     }
   }
 
-  size_t len;
-  err = js_get_value_string_utf8(env, argv[0], NULL, 0, &len);
-  assert(err == 0);
+  utf8_t stack[BARE_URL_STACK_STRING_MAX];
 
-  utf8_t *input = malloc(len);
-  err = js_get_value_string_utf8(env, argv[0], input, len, NULL);
-  assert(err == 0);
+  bare_url_string_t input;
+  bare_url__read_string(env, argv[0], stack, sizeof(stack), &input);
 
   url_t url;
   url_init(&url);
 
-  err = url_parse(&url, input, len, has_base ? &base : NULL);
+  err = url_parse(&url, input.data, input.len, has_base ? &base : NULL);
 
-  free(input);
+  bare_url__free_string(env, &input);
 
   url_destroy(&base);
   url_destroy(&url);
@@ -164,7 +233,7 @@ bare_url_can_parse (js_env_t *env, js_callback_info_t *info) {
 }
 
 static js_value_t *
-bare_url_exports (js_env_t *env, js_value_t *exports) {
+bare_url_exports(js_env_t *env, js_value_t *exports) {
   int err;
 
 #define V(name, fn) \

package/index.js

@@ -7,6 +7,20 @@ const kind = Symbol.for('bare.url.kind')
 
 const isWindows = Bare.platform === 'win32'
 
+// Scratch buffer that the binding writes the parsed component offsets into. A
+// single shared buffer is reused across every parse.
+//
+// The offsets are copied out into fields on the URL immediately after a
+// successful parse, so nothing observes the buffer across calls.
+const components = new Uint32Array(8)
+
+// The value used for a component that is not present in the URL.
+const unset = 0xffffffff
+
+// The characters that pathToFileURL() has to percent-encode itself. A backslash
+// is a path separator on Windows and so is left alone there.
+const reserved = isWindows ? /[%#?\n\r\t]/ : /[%#?\n\r\t\\]/
+
 class URL {
   static get [kind]() {
     return 0 // Compatibility version
@@ -19,11 +33,17 @@ class URL {
 
     if (base !== undefined) base = String(base)
 
-    this._components = new Uint32Array(8)
+    this._href = undefined
+    this._schemeEnd = 0
+    this._usernameEnd = 0
+    this._hostStart = 0
+    this._hostEnd = 0
+    this._pathStart = 0
+    this._queryStart = 0
+    this._fragmentStart = 0
+    this._params = null
 
     this._parse(input, base, opts.throw !== false)
-
-    if (this._href) this._params = new URLSearchParams(this.search, this)
   }
 
   get [kind]() {
@@ -39,23 +59,23 @@ class URL {
   set href(value) {
     this._update(value)
 
-    this._params._parse(this.search)
+    if (this._params) this._params._parse(this.search)
   }
 
   // https://url.spec.whatwg.org/#dom-url-protocol
 
   get protocol() {
-    return this._slice(0, this._components[0]) + ':'
+    return this._slice(0, this._schemeEnd) + ':'
   }
 
   set protocol(value) {
-    this._update(this._replace(value.replace(/:+$/, ''), 0, this._components[0]))
+    this._update(this._replace(value.replace(/:+$/, ''), 0, this._schemeEnd))
   }
 
   // https://url.spec.whatwg.org/#dom-url-username
 
   get username() {
-    return this._slice(this._components[0] + 3 /* :// */, this._components[1])
+    return this._slice(this._schemeEnd + 3 /* :// */, this._usernameEnd)
   }
 
   set username(value) {
@@ -65,13 +85,13 @@ class URL {
 
     if (this.username === '') value += '@'
 
-    this._update(this._replace(value, this._components[0] + 3 /* :// */, this._components[1]))
+    this._update(this._replace(value, this._schemeEnd + 3 /* :// */, this._usernameEnd))
   }
 
   // https://url.spec.whatwg.org/#dom-url-password
 
   get password() {
-    return this._href.slice(this._components[1] + 1 /* : */, this._components[2] - 1 /* @ */)
+    return this._href.slice(this._usernameEnd + 1 /* : */, this._hostStart - 1 /* @ */)
   }
 
   set password(value) {
@@ -79,8 +99,8 @@ class URL {
       return
     }
 
-    let start = this._components[1] + 1 /* : */
-    let end = this._components[2] - 1 /* @ */
+    let start = this._usernameEnd + 1 /* : */
+    let end = this._hostStart - 1 /* @ */
 
     if (this.password === '') {
       value = ':' + value
@@ -98,7 +118,7 @@ class URL {
   // https://url.spec.whatwg.org/#dom-url-host
 
   get host() {
-    return this._slice(this._components[2], this._components[5])
+    return this._slice(this._hostStart, this._pathStart)
   }
 
   set host(value) {
@@ -107,14 +127,14 @@ class URL {
     }
 
     this._update(
-      this._replace(value, this._components[2], this._components[value.includes(':') ? 5 : 3])
+      this._replace(value, this._hostStart, value.includes(':') ? this._pathStart : this._hostEnd)
     )
   }
 
   // https://url.spec.whatwg.org/#dom-url-hostname
 
   get hostname() {
-    return this._slice(this._components[2], this._components[3])
+    return this._slice(this._hostStart, this._hostEnd)
   }
 
   set hostname(value) {
@@ -122,13 +142,13 @@ class URL {
       return
     }
 
-    this._update(this._replace(value, this._components[2], this._components[3]))
+    this._update(this._replace(value, this._hostStart, this._hostEnd))
   }
 
   // https://url.spec.whatwg.org/#dom-url-port
 
   get port() {
-    return this._slice(this._components[3] + 1 /* : */, this._components[5])
+    return this._slice(this._hostEnd + 1 /* : */, this._pathStart)
   }
 
   set port(value) {
@@ -136,20 +156,20 @@ class URL {
       return
     }
 
-    let start = this._components[3] + 1 /* : */
+    let start = this._hostEnd + 1 /* : */
 
     if (this.port === '') {
       value = ':' + value
       start--
     }
 
-    this._update(this._replace(value, start, this._components[5]))
+    this._update(this._replace(value, start, this._pathStart))
   }
 
   // https://url.spec.whatwg.org/#dom-url-pathname
 
   get pathname() {
-    return this._slice(this._components[5], this._components[6] - 1 /* ? */)
+    return this._slice(this._pathStart, this._queryStart - 1 /* ? */)
   }
 
   set pathname(value) {
@@ -161,41 +181,45 @@ class URL {
       value = '/' + value
     }
 
-    this._update(this._replace(value, this._components[5], this._components[6] - 1 /* ? */))
+    this._update(this._replace(value, this._pathStart, this._queryStart - 1 /* ? */))
   }
 
   // https://url.spec.whatwg.org/#dom-url-search
 
   get search() {
-    return this._slice(this._components[6] - 1 /* ? */, this._components[7] - 1 /* # */)
+    return this._slice(this._queryStart - 1 /* ? */, this._fragmentStart - 1 /* # */)
   }
 
   set search(value) {
     if (value && value[0] !== '?') value = '?' + value
 
     this._update(
-      this._replace(value, this._components[6] - 1 /* ? */, this._components[7] - 1 /* # */)
+      this._replace(value, this._queryStart - 1 /* ? */, this._fragmentStart - 1 /* # */)
     )
 
-    this._params._parse(this.search)
+    if (this._params) this._params._parse(this.search)
   }
 
   // https://url.spec.whatwg.org/#dom-url-searchparams
 
   get searchParams() {
+    if (this._params === null) {
+      this._params = new URLSearchParams(this.search, this)
+    }
+
     return this._params
   }
 
   // https://url.spec.whatwg.org/#dom-url-hash
 
   get hash() {
-    return this._slice(this._components[7] - 1 /* # */)
+    return this._slice(this._fragmentStart - 1 /* # */)
   }
 
   set hash(value) {
     if (value && value[0] !== '#') value = '#' + value
 
-    this._update(this._replace(value, this._components[7] - 1 /* # */))
+    this._update(this._replace(value, this._fragmentStart - 1 /* # */))
   }
 
   toString() {
@@ -233,18 +257,32 @@ class URL {
   }
 
   _parse(input, base, shouldThrow) {
+    let href
+
     try {
-      this._href = binding.parse(
-        String(input),
-        base ? String(base) : null,
-        this._components,
-        shouldThrow
-      )
+      href = binding.parse(input, base || null, components, shouldThrow)
     } catch (err) {
       if (err instanceof TypeError) throw err
 
       throw errors.INVALID_URL(`Invalid URL '${input}'`, input)
     }
+
+    if (href === undefined) return
+
+    this._href = href
+    this._schemeEnd = components[0]
+    this._usernameEnd = components[1]
+    this._hostStart = components[2]
+    this._hostEnd = components[3]
+    this._pathStart = components[5]
+
+    const queryStart = components[6]
+    const fragmentStart = components[7]
+
+    const end = href.length + 1
+
+    this._queryStart = queryStart === unset ? end : queryStart
+    this._fragmentStart = fragmentStart === unset ? end : fragmentStart
   }
 
   _update(input) {
@@ -301,27 +339,35 @@ exports.fileURLToPath = function fileURLToPath(url) {
     throw errors.INVALID_URL_SCHEME('The URL must use the file: protocol')
   }
 
-  if (isWindows) {
-    if (/%2f|%5c/i.test(url.pathname)) {
-      throw errors.INVALID_FILE_URL_PATH(
-        'The file: URL path must not include encoded \\ or / characters'
-      )
-    }
-  } else {
-    if (url.hostname) {
-      throw errors.INVALID_FILE_URL_HOST("The file: URL host must be 'localhost' or empty")
-    }
+  if (!isWindows && url.hostname) {
+    throw errors.INVALID_FILE_URL_HOST("The file: URL host must be 'localhost' or empty")
+  }
+
+  const encoded = url.pathname
 
-    if (/%2f/i.test(url.pathname)) {
+  // Every check below looks for a percent encoded sequence, as does the decoding
+  // that follows, so a path without any can skip all of them.
+  const hasEncoded = encoded.includes('%')
+
+  if (hasEncoded) {
+    if (isWindows) {
+      if (/%2f|%5c/i.test(encoded)) {
+        throw errors.INVALID_FILE_URL_PATH(
+          'The file: URL path must not include encoded \\ or / characters'
+        )
+      }
+    } else if (/%2f/i.test(encoded)) {
       throw errors.INVALID_FILE_URL_PATH('The file: URL path must not include encoded / characters')
     }
-  }
 
-  if (/%00/i.test(url.pathname)) {
-    throw errors.INVALID_FILE_URL_PATH('The file: URL path must not include encoded NUL characters')
+    if (/%00/i.test(encoded)) {
+      throw errors.INVALID_FILE_URL_PATH(
+        'The file: URL path must not include encoded NUL characters'
+      )
+    }
   }
 
-  const pathname = path.normalize(decodeURIComponent(url.pathname))
+  const pathname = path.normalize(hasEncoded ? decodeURIComponent(encoded) : encoded)
 
   if (isWindows) {
     if (url.hostname) return '\\\\' + url.hostname + pathname
@@ -347,16 +393,20 @@ exports.pathToFileURL = function pathToFileURL(pathname) {
     resolved += '\\'
   }
 
-  resolved = resolved
-    .replaceAll('%', '%25') // Must be first
-    .replaceAll('#', '%23')
-    .replaceAll('?', '%3f')
-    .replaceAll('\n', '%0a')
-    .replaceAll('\r', '%0d')
-    .replaceAll('\t', '%09')
+  // Paths hardly ever contain any of these, so one pass to rule them out is
+  // cheaper than the six or seven replacements it stands in for.
+  if (reserved.test(resolved)) {
+    resolved = resolved
+      .replaceAll('%', '%25') // Must be first
+      .replaceAll('#', '%23')
+      .replaceAll('?', '%3f')
+      .replaceAll('\n', '%0a')
+      .replaceAll('\r', '%0d')
+      .replaceAll('\t', '%09')
 
-  if (!isWindows) {
-    resolved = resolved.replaceAll('\\', '%5c')
+    if (!isWindows) {
+      resolved = resolved.replaceAll('\\', '%5c')
+    }
   }
 
   return new URL('file:' + resolved)

package/lib/url-search-params.js

@@ -9,17 +9,21 @@ class URLSearchParams {
 
   // https://url.spec.whatwg.org/#dom-urlsearchparams-urlsearchparams
   constructor(init, url = null) {
-    this._params = new Map()
+    this._params = null
 
     if (url) URLSearchParams._urls.set(this, url)
 
     if (typeof init === 'string') {
       this._parse(init)
-    } else if (init) {
-      for (const [name, value] of typeof init[Symbol.iterator] === 'function'
-        ? init
-        : Object.entries(init)) {
-        this.append(name, value)
+    } else {
+      this._params = new Map()
+
+      if (init) {
+        for (const [name, value] of typeof init[Symbol.iterator] === 'function'
+          ? init
+          : Object.entries(init)) {
+          this.append(name, value)
+        }
       }
     }
   }
@@ -30,7 +34,11 @@ class URLSearchParams {
 
   // https://url.spec.whatwg.org/#dom-urlsearchparams-size
   get size() {
-    return this._params.length
+    let size = 0
+
+    for (const values of this._params.values()) size += values.length
+
+    return size
   }
 
   // https://url.spec.whatwg.org/#dom-urlsearchparams-append
@@ -141,47 +149,51 @@ class URLSearchParams {
 
   // https://url.spec.whatwg.org/#concept-urlencoded-parser
   _parse(input) {
-    if (input[0] === '?') input = input.substring(1)
+    const params = new Map()
 
-    this._params = new Map()
+    this._params = params
 
-    for (let sequence of input.split('&')) {
-      if (sequence.length === 0) continue
+    const len = input.length
 
-      sequence = sequence.replace(/\+/g, ' ')
+    let start = input.charCodeAt(0) === 0x3f /* ? */ ? 1 : 0
 
-      let i = sequence.indexOf('=')
-      if (i === -1) i = sequence.length
+    while (start < len) {
+      let end = input.indexOf('&', start)
+      if (end === -1) end = len
 
-      const name = decodeURIComponent(sequence.substring(0, i))
-      const value = decodeURIComponent(sequence.substring(i + 1, sequence.length))
+      if (end !== start) {
+        let split = input.indexOf('=', start)
+        if (split === -1 || split > end) split = end
 
-      let list = this._params.get(name)
+        const name = decode(input.slice(start, split))
+        const value = split === end ? '' : decode(input.slice(split + 1, end))
 
-      if (list === undefined) {
-        list = []
-        this._params.set(name, list)
+        const list = params.get(name)
+
+        if (list === undefined) params.set(name, [value])
+        else list.push(value)
       }
 
-      list.push(value)
+      start = end + 1
     }
   }
 
   // https://url.spec.whatwg.org/#concept-urlencoded-serializer
   _serialize() {
-    let output = ''
+    let result = ''
+    let separator = ''
 
-    for (let [name, values] of this._params) {
-      name = encodeURIComponent(name)
+    for (const [name, values] of this._params) {
+      // The name is shared by all of its values, so it is only encoded once.
+      const encoded = encode(String(name))
 
       for (const value of values) {
-        if (output) output += '&'
-
-        output += name + '=' + encodeURIComponent(value)
+        result += separator + encoded + '=' + encode(String(value))
+        separator = '&'
       }
     }
 
-    return output
+    return result
   }
 }
 
@@ -192,3 +204,66 @@ exports.isURLSearchParams = function isURLSearchParams(value) {
 
   return typeof value === 'object' && value !== null && value[kind] === URLSearchParams[kind]
 }
+
+// https://url.spec.whatwg.org/#concept-urlencoded-byte-serializer
+//
+// Everything except ASCII alphanumerics and `*-._` is percent-encoded, and a
+// space becomes `+` rather than `%20`. Names and values usually consist entirely
+// of characters that are left alone, so a component is tested as a whole before
+// any of it is rewritten.
+const unencoded = /^[\w*.-]*$/
+
+// As above, but allowing spaces, which need nothing more than turning into `+`.
+// Spaces are by far the most common reason for a component to need rewriting at
+// all, so recognizing them here spares those components a trip through
+// encodeURIComponent().
+const spaced = /^[\w*. -]*$/
+
+// The characters that encodeURIComponent() leaves alone but the urlencoded byte
+// serializer does not. Two patterns are needed because a global regular
+// expression cannot be shared between test() and replace(), as test() advances
+// its lastIndex.
+const extra = /[!'()~]/
+const extraAll = /[!'()~]/g
+
+const escapes = {
+  '!': '%21',
+  "'": '%27',
+  '(': '%28',
+  ')': '%29',
+  '~': '%7E'
+}
+
+// A surrogate that is not part of a pair, and so does not encode a scalar value.
+const lone = /[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/g
+
+function encode(component) {
+  if (unencoded.test(component)) return component
+
+  if (spaced.test(component)) return component.replaceAll(' ', '+')
+
+  let encoded
+
+  try {
+    encoded = encodeURIComponent(component)
+  } catch {
+    // encodeURIComponent() rejects lone surrogates, whereas the UTF-8 encoder the
+    // serializer is defined in terms of replaces them with U+FFFD.
+    encoded = encodeURIComponent(component.replace(lone, '\ufffd'))
+  }
+
+  if (encoded.includes('%20')) encoded = encoded.replaceAll('%20', '+')
+
+  if (extra.test(encoded)) encoded = encoded.replace(extraAll, (match) => escapes[match])
+
+  return encoded
+}
+
+// https://url.spec.whatwg.org/#percent-decode-after-encoding
+function decode(component) {
+  if (component.indexOf('+') !== -1) component = component.replaceAll('+', ' ')
+
+  if (component.indexOf('%') === -1) return component
+
+  return decodeURIComponent(component)
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bare-url",
-  "version": "2.5.0",
+  "version": "2.5.2",
   "description": "WHATWG URL implementation for JavaScript",
   "exports": {
     "./package": "./package.json",
@@ -45,7 +45,7 @@
   },
   "devDependencies": {
     "brittle": "^3.3.2",
-    "cmake-bare": "^1.1.6",
+    "cmake-bare": "^1.8.1",
     "cmake-fetch": "^1.0.0",
     "lunte": "^1.6.0",
     "prettier": "^3.3.3",