bare-url 2.5.1 → 2.5.2

package/binding.c

@@ -5,109 +5,90 @@
 #include <stdlib.h>
 #include <string.h>
 #include <url.h>
-#include <url/character-set.h>
-#include <url/percent-encode.h>
 #include <utf.h>
 #include <utf/string.h>
 
-// https://url.spec.whatwg.org/#concept-urlencoded-byte-serializer
-//
-// Everything except ASCII alphanumerics and `*-._` is percent-encoded. A space
-// (0x20) is a special case, encoded as `+` rather than `%20`, so it is left out
-// of the set and handled separately below.
-static url_character_set_t bare_url__form_urlencoded_percent_encode_set = {
-  // 00    01     02     03     04     05     06     07
-  0x01 | 0x02 | 0x04 | 0x08 | 0x10 | 0x20 | 0x40 | 0x80,
-  // 08    09     0a     0b     0c     0d     0e     0f
-  0x01 | 0x02 | 0x04 | 0x08 | 0x10 | 0x20 | 0x40 | 0x80,
-  // 10    11     12     13     14     15     16     17
-  0x01 | 0x02 | 0x04 | 0x08 | 0x10 | 0x20 | 0x40 | 0x80,
-  // 18    19     1a     1b     1c     1d     1e     1f
-  0x01 | 0x02 | 0x04 | 0x08 | 0x10 | 0x20 | 0x40 | 0x80,
-  // 20    21     22     23     24     25     26     27
-  0x00 | 0x02 | 0x04 | 0x08 | 0x10 | 0x20 | 0x40 | 0x80,
-  // 28    29     2a     2b     2c     2d     2e     2f
-  0x01 | 0x02 | 0x00 | 0x08 | 0x10 | 0x00 | 0x00 | 0x80,
-  // 30    31     32     33     34     35     36     37
-  0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00,
-  // 38    39     3a     3b     3c     3d     3e     3f
-  0x00 | 0x00 | 0x04 | 0x08 | 0x10 | 0x20 | 0x40 | 0x80,
-  // 40    41     42     43     44     45     46     47
-  0x01 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00,
-  // 48    49     4a     4b     4c     4d     4e     4f
-  0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00,
-  // 50    51     52     53     54     55     56     57
-  0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00,
-  // 58    59     5a     5b     5c     5d     5e     5f
-  0x00 | 0x00 | 0x00 | 0x08 | 0x10 | 0x20 | 0x40 | 0x00,
-  // 60    61     62     63     64     65     66     67
-  0x01 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00,
-  // 68    69     6a     6b     6c     6d     6e     6f
-  0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00,
-  // 70    71     72     73     74     75     76     77
-  0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00,
-  // 78    79     7a     7b     7c     7d     7e     7f
-  0x00 | 0x00 | 0x00 | 0x08 | 0x10 | 0x20 | 0x40 | 0x80,
-  // 80    81     82     83     84     85     86     87
-  0x01 | 0x02 | 0x04 | 0x08 | 0x10 | 0x20 | 0x40 | 0x80,
-  // 88    89     8a     8b     8c     8d     8e     8f
-  0x01 | 0x02 | 0x04 | 0x08 | 0x10 | 0x20 | 0x40 | 0x80,
-  // 90    91     92     93     94     95     96     97
-  0x01 | 0x02 | 0x04 | 0x08 | 0x10 | 0x20 | 0x40 | 0x80,
-  // 98    99     9a     9b     9c     9d     9e     9f
-  0x01 | 0x02 | 0x04 | 0x08 | 0x10 | 0x20 | 0x40 | 0x80,
-  // a0    a1     a2     a3     a4     a5     a6     a7
-  0x01 | 0x02 | 0x04 | 0x08 | 0x10 | 0x20 | 0x40 | 0x80,
-  // a8    a9     aa     ab     ac     ad     ae     af
-  0x01 | 0x02 | 0x04 | 0x08 | 0x10 | 0x20 | 0x40 | 0x80,
-  // b0    b1     b2     b3     b4     b5     b6     b7
-  0x01 | 0x02 | 0x04 | 0x08 | 0x10 | 0x20 | 0x40 | 0x80,
-  // b8    b9     ba     bb     bc     bd     be     bf
-  0x01 | 0x02 | 0x04 | 0x08 | 0x10 | 0x20 | 0x40 | 0x80,
-  // c0    c1     c2     c3     c4     c5     c6     c7
-  0x01 | 0x02 | 0x04 | 0x08 | 0x10 | 0x20 | 0x40 | 0x80,
-  // c8    c9     ca     cb     cc     cd     ce     cf
-  0x01 | 0x02 | 0x04 | 0x08 | 0x10 | 0x20 | 0x40 | 0x80,
-  // d0    d1     d2     d3     d4     d5     d6     d7
-  0x01 | 0x02 | 0x04 | 0x08 | 0x10 | 0x20 | 0x40 | 0x80,
-  // d8    d9     da     db     dc     dd     de     df
-  0x01 | 0x02 | 0x04 | 0x08 | 0x10 | 0x20 | 0x40 | 0x80,
-  // e0    e1     e2     e3     e4     e5     e6     e7
-  0x01 | 0x02 | 0x04 | 0x08 | 0x10 | 0x20 | 0x40 | 0x80,
-  // e8    e9     ea     eb     ec     ed     ee     ef
-  0x01 | 0x02 | 0x04 | 0x08 | 0x10 | 0x20 | 0x40 | 0x80,
-  // f0    f1     f2     f3     f4     f5     f6     f7
-  0x01 | 0x02 | 0x04 | 0x08 | 0x10 | 0x20 | 0x40 | 0x80,
-  // f8    f9     fa     fb     fc     fd     fe     ff
-  0x01 | 0x02 | 0x04 | 0x08 | 0x10 | 0x20 | 0x40 | 0x80,
-};
-
-// https://url.spec.whatwg.org/#concept-urlencoded-serializer
-static void
-bare_url__serialize_form_urlencoded_component(js_env_t *env, js_value_t *value, utf8_string_t *result) {
+// Maximum length, in bytes, of a UTF-8 string that is read into a stack buffer.
+// Longer strings fall back to a heap allocation. This covers the vast majority
+// of URLs without touching the heap.
+#define BARE_URL_STACK_STRING_MAX 1024
+
+// The UTF-8 encoding of a JavaScript string, together with whatever backs it.
+typedef struct {
+  const utf8_t *data;
+  size_t len;
+
+  js_string_view_t *view;
+  utf8_t *heap;
+} bare_url_string_t;
+
+// Exposes `value` as UTF-8. Strings that are stored as ASCII, which is nearly
+// all of them, are borrowed directly from the engine without being copied.
+// Anything else is transcoded into `stack`, or into a freshly allocated heap
+// buffer when it does not fit. The result must be released with
+// bare_url__free_string().
+static inline void
+bare_url__read_string(js_env_t *env, js_value_t *value, utf8_t *stack, size_t stack_len, bare_url_string_t *result) {
   int err;
 
+  js_string_encoding_t encoding;
+  const void *data;
   size_t len;
-  err = js_get_value_string_utf8(env, value, NULL, 0, &len);
-  assert(err == 0);
 
-  utf8_t *input = malloc(len);
-  err = js_get_value_string_utf8(env, value, input, len, NULL);
+  err = js_get_string_view(env, value, &encoding, &data, &len, &result->view);
   assert(err == 0);
 
-  for (size_t i = 0; i < len; i++) {
-    utf8_t c = input[i];
+  result->heap = NULL;
 
-    if (c == 0x20 /* space */) {
-      err = utf8_string_append_character(result, '+');
-    } else {
-      err = url__percent_encode_character(c, bare_url__form_urlencoded_percent_encode_set, result);
+  size_t utf8_len;
+
+  if (encoding == js_utf8) {
+    result->data = (const utf8_t *) data;
+    result->len = len;
+
+    return;
+  }
+
+  if (encoding == js_latin1) {
+    utf8_len = utf8_length_from_latin1((const latin1_t *) data, len);
+
+    // A Latin-1 string that is no longer as UTF-8 contains only ASCII, whose
+    // Latin-1 and UTF-8 encodings are identical.
+    if (utf8_len == len) {
+      result->data = (const utf8_t *) data;
+      result->len = len;
+
+      return;
     }
+  } else {
+    assert(encoding == js_utf16le);
+
+    utf8_len = utf8_length_from_utf16le((const utf16_t *) data, len);
+  }
+
+  utf8_t *buffer = utf8_len <= stack_len ? stack : (result->heap = malloc(utf8_len));
 
-    assert(err == 0);
+  if (encoding == js_latin1) {
+    latin1_convert_to_utf8((const latin1_t *) data, len, buffer);
+  } else {
+    utf16le_convert_to_utf8((const utf16_t *) data, len, buffer);
   }
 
-  free(input);
+  result->data = buffer;
+  result->len = utf8_len;
+}
+
+// Releases a string read with bare_url__read_string(), freeing its buffer only
+// when it was heap allocated rather than borrowed or written to the caller's
+// stack buffer.
+static inline void
+bare_url__free_string(js_env_t *env, bare_url_string_t *string) {
+  int err;
+
+  free(string->heap);
+
+  err = js_release_string_view(env, string->view);
+  assert(err == 0);
 }
 
 static js_value_t *
@@ -134,17 +115,14 @@ bare_url_parse(js_env_t *env, js_callback_info_t *info) {
   url_init(&base);
 
   if (has_base) {
-    size_t len;
-    err = js_get_value_string_utf8(env, argv[1], NULL, 0, &len);
-    assert(err == 0);
+    utf8_t stack[BARE_URL_STACK_STRING_MAX];
 
-    utf8_t *input = malloc(len);
-    err = js_get_value_string_utf8(env, argv[1], input, len, NULL);
-    assert(err == 0);
+    bare_url_string_t input;
+    bare_url__read_string(env, argv[1], stack, sizeof(stack), &input);
 
-    err = url_parse(&base, input, len, NULL);
+    err = url_parse(&base, input.data, input.len, NULL);
 
-    free(input);
+    bare_url__free_string(env, &input);
 
     if (err < 0) {
       url_destroy(&base);
@@ -155,22 +133,17 @@ bare_url_parse(js_env_t *env, js_callback_info_t *info) {
     }
   }
 
-  size_t len;
-  err = js_get_value_string_utf8(env, argv[0], NULL, 0, &len);
-  assert(err == 0);
-
-  utf8_t *input = malloc(len);
-  err = js_get_value_string_utf8(env, argv[0], input, len, NULL);
-  assert(err == 0);
+  utf8_t stack[BARE_URL_STACK_STRING_MAX];
 
-  js_value_t *handle;
+  bare_url_string_t input;
+  bare_url__read_string(env, argv[0], stack, sizeof(stack), &input);
 
   url_t url;
   url_init(&url);
 
-  err = url_parse(&url, input, len, has_base ? &base : NULL);
+  err = url_parse(&url, input.data, input.len, has_base ? &base : NULL);
 
-  free(input);
+  bare_url__free_string(env, &input);
 
   if (err < 0) {
     url_destroy(&base);
@@ -182,7 +155,7 @@ bare_url_parse(js_env_t *env, js_callback_info_t *info) {
   }
 
   js_value_t *href;
-  err = js_create_string_utf8(env, url.href.data, url.href.len, &href);
+  err = js_create_string_latin1(env, (const latin1_t *) url.href.data, url.href.len, &href);
   assert(err == 0);
 
   uint32_t *components;
@@ -217,17 +190,14 @@ bare_url_can_parse(js_env_t *env, js_callback_info_t *info) {
   url_init(&base);
 
   if (has_base) {
-    size_t len;
-    err = js_get_value_string_utf8(env, argv[1], NULL, 0, &len);
-    assert(err == 0);
+    utf8_t stack[BARE_URL_STACK_STRING_MAX];
 
-    utf8_t *input = malloc(len);
-    err = js_get_value_string_utf8(env, argv[1], input, len, NULL);
-    assert(err == 0);
+    bare_url_string_t input;
+    bare_url__read_string(env, argv[1], stack, sizeof(stack), &input);
 
-    err = url_parse(&base, input, len, NULL);
+    err = url_parse(&base, input.data, input.len, NULL);
 
-    free(input);
+    bare_url__free_string(env, &input);
 
     if (err < 0) {
       url_destroy(&base);
@@ -240,20 +210,17 @@ bare_url_can_parse(js_env_t *env, js_callback_info_t *info) {
     }
   }
 
-  size_t len;
-  err = js_get_value_string_utf8(env, argv[0], NULL, 0, &len);
-  assert(err == 0);
+  utf8_t stack[BARE_URL_STACK_STRING_MAX];
 
-  utf8_t *input = malloc(len);
-  err = js_get_value_string_utf8(env, argv[0], input, len, NULL);
-  assert(err == 0);
+  bare_url_string_t input;
+  bare_url__read_string(env, argv[0], stack, sizeof(stack), &input);
 
   url_t url;
   url_init(&url);
 
-  err = url_parse(&url, input, len, has_base ? &base : NULL);
+  err = url_parse(&url, input.data, input.len, has_base ? &base : NULL);
 
-  free(input);
+  bare_url__free_string(env, &input);
 
   url_destroy(&base);
   url_destroy(&url);
@@ -265,56 +232,6 @@ bare_url_can_parse(js_env_t *env, js_callback_info_t *info) {
   return result;
 }
 
-static js_value_t *
-bare_url_serialize_form_urlencoded(js_env_t *env, js_callback_info_t *info) {
-  int err;
-
-  size_t argc = 1;
-  js_value_t *argv[1];
-
-  err = js_get_callback_info(env, info, &argc, argv, NULL, NULL);
-  assert(err == 0);
-
-  assert(argc == 1);
-
-  uint32_t len;
-  err = js_get_array_length(env, argv[0], &len);
-  assert(err == 0);
-
-  utf8_string_t result;
-  utf8_string_init(&result);
-
-  for (uint32_t i = 0; i + 1 < len; i += 2) {
-    js_value_t *pair[2];
-
-    err = js_get_element(env, argv[0], i, &pair[0]);
-    assert(err == 0);
-
-    err = js_get_element(env, argv[0], i + 1, &pair[1]);
-    assert(err == 0);
-
-    if (i != 0) {
-      err = utf8_string_append_character(&result, '&');
-      assert(err == 0);
-    }
-
-    bare_url__serialize_form_urlencoded_component(env, pair[0], &result);
-
-    err = utf8_string_append_character(&result, '=');
-    assert(err == 0);
-
-    bare_url__serialize_form_urlencoded_component(env, pair[1], &result);
-  }
-
-  js_value_t *output;
-  err = js_create_string_utf8(env, result.data, result.len, &output);
-  assert(err == 0);
-
-  utf8_string_destroy(&result);
-
-  return output;
-}
-
 static js_value_t *
 bare_url_exports(js_env_t *env, js_value_t *exports) {
   int err;
@@ -330,7 +247,6 @@ bare_url_exports(js_env_t *env, js_value_t *exports) {
 
   V("parse", bare_url_parse)
   V("canParse", bare_url_can_parse)
-  V("serializeSearchParams", bare_url_serialize_form_urlencoded)
 #undef V
 
   return exports;

package/index.js

@@ -7,6 +7,20 @@ const kind = Symbol.for('bare.url.kind')
 
 const isWindows = Bare.platform === 'win32'
 
+// Scratch buffer that the binding writes the parsed component offsets into. A
+// single shared buffer is reused across every parse.
+//
+// The offsets are copied out into fields on the URL immediately after a
+// successful parse, so nothing observes the buffer across calls.
+const components = new Uint32Array(8)
+
+// The value used for a component that is not present in the URL.
+const unset = 0xffffffff
+
+// The characters that pathToFileURL() has to percent-encode itself. A backslash
+// is a path separator on Windows and so is left alone there.
+const reserved = isWindows ? /[%#?\n\r\t]/ : /[%#?\n\r\t\\]/
+
 class URL {
   static get [kind]() {
     return 0 // Compatibility version
@@ -19,11 +33,17 @@ class URL {
 
     if (base !== undefined) base = String(base)
 
-    this._components = new Uint32Array(8)
+    this._href = undefined
+    this._schemeEnd = 0
+    this._usernameEnd = 0
+    this._hostStart = 0
+    this._hostEnd = 0
+    this._pathStart = 0
+    this._queryStart = 0
+    this._fragmentStart = 0
+    this._params = null
 
     this._parse(input, base, opts.throw !== false)
-
-    if (this._href) this._params = new URLSearchParams(this.search, this)
   }
 
   get [kind]() {
@@ -39,23 +59,23 @@ class URL {
   set href(value) {
     this._update(value)
 
-    this._params._parse(this.search)
+    if (this._params) this._params._parse(this.search)
   }
 
   // https://url.spec.whatwg.org/#dom-url-protocol
 
   get protocol() {
-    return this._slice(0, this._components[0]) + ':'
+    return this._slice(0, this._schemeEnd) + ':'
   }
 
   set protocol(value) {
-    this._update(this._replace(value.replace(/:+$/, ''), 0, this._components[0]))
+    this._update(this._replace(value.replace(/:+$/, ''), 0, this._schemeEnd))
   }
 
   // https://url.spec.whatwg.org/#dom-url-username
 
   get username() {
-    return this._slice(this._components[0] + 3 /* :// */, this._components[1])
+    return this._slice(this._schemeEnd + 3 /* :// */, this._usernameEnd)
   }
 
   set username(value) {
@@ -65,13 +85,13 @@ class URL {
 
     if (this.username === '') value += '@'
 
-    this._update(this._replace(value, this._components[0] + 3 /* :// */, this._components[1]))
+    this._update(this._replace(value, this._schemeEnd + 3 /* :// */, this._usernameEnd))
   }
 
   // https://url.spec.whatwg.org/#dom-url-password
 
   get password() {
-    return this._href.slice(this._components[1] + 1 /* : */, this._components[2] - 1 /* @ */)
+    return this._href.slice(this._usernameEnd + 1 /* : */, this._hostStart - 1 /* @ */)
   }
 
   set password(value) {
@@ -79,8 +99,8 @@ class URL {
       return
     }
 
-    let start = this._components[1] + 1 /* : */
-    let end = this._components[2] - 1 /* @ */
+    let start = this._usernameEnd + 1 /* : */
+    let end = this._hostStart - 1 /* @ */
 
     if (this.password === '') {
       value = ':' + value
@@ -98,7 +118,7 @@ class URL {
   // https://url.spec.whatwg.org/#dom-url-host
 
   get host() {
-    return this._slice(this._components[2], this._components[5])
+    return this._slice(this._hostStart, this._pathStart)
   }
 
   set host(value) {
@@ -107,14 +127,14 @@ class URL {
     }
 
     this._update(
-      this._replace(value, this._components[2], this._components[value.includes(':') ? 5 : 3])
+      this._replace(value, this._hostStart, value.includes(':') ? this._pathStart : this._hostEnd)
     )
   }
 
   // https://url.spec.whatwg.org/#dom-url-hostname
 
   get hostname() {
-    return this._slice(this._components[2], this._components[3])
+    return this._slice(this._hostStart, this._hostEnd)
   }
 
   set hostname(value) {
@@ -122,13 +142,13 @@ class URL {
       return
     }
 
-    this._update(this._replace(value, this._components[2], this._components[3]))
+    this._update(this._replace(value, this._hostStart, this._hostEnd))
   }
 
   // https://url.spec.whatwg.org/#dom-url-port
 
   get port() {
-    return this._slice(this._components[3] + 1 /* : */, this._components[5])
+    return this._slice(this._hostEnd + 1 /* : */, this._pathStart)
   }
 
   set port(value) {
@@ -136,20 +156,20 @@ class URL {
       return
     }
 
-    let start = this._components[3] + 1 /* : */
+    let start = this._hostEnd + 1 /* : */
 
     if (this.port === '') {
       value = ':' + value
       start--
     }
 
-    this._update(this._replace(value, start, this._components[5]))
+    this._update(this._replace(value, start, this._pathStart))
   }
 
   // https://url.spec.whatwg.org/#dom-url-pathname
 
   get pathname() {
-    return this._slice(this._components[5], this._components[6] - 1 /* ? */)
+    return this._slice(this._pathStart, this._queryStart - 1 /* ? */)
   }
 
   set pathname(value) {
@@ -161,41 +181,45 @@ class URL {
       value = '/' + value
     }
 
-    this._update(this._replace(value, this._components[5], this._components[6] - 1 /* ? */))
+    this._update(this._replace(value, this._pathStart, this._queryStart - 1 /* ? */))
   }
 
   // https://url.spec.whatwg.org/#dom-url-search
 
   get search() {
-    return this._slice(this._components[6] - 1 /* ? */, this._components[7] - 1 /* # */)
+    return this._slice(this._queryStart - 1 /* ? */, this._fragmentStart - 1 /* # */)
   }
 
   set search(value) {
     if (value && value[0] !== '?') value = '?' + value
 
     this._update(
-      this._replace(value, this._components[6] - 1 /* ? */, this._components[7] - 1 /* # */)
+      this._replace(value, this._queryStart - 1 /* ? */, this._fragmentStart - 1 /* # */)
     )
 
-    this._params._parse(this.search)
+    if (this._params) this._params._parse(this.search)
   }
 
   // https://url.spec.whatwg.org/#dom-url-searchparams
 
   get searchParams() {
+    if (this._params === null) {
+      this._params = new URLSearchParams(this.search, this)
+    }
+
     return this._params
   }
 
   // https://url.spec.whatwg.org/#dom-url-hash
 
   get hash() {
-    return this._slice(this._components[7] - 1 /* # */)
+    return this._slice(this._fragmentStart - 1 /* # */)
   }
 
   set hash(value) {
     if (value && value[0] !== '#') value = '#' + value
 
-    this._update(this._replace(value, this._components[7] - 1 /* # */))
+    this._update(this._replace(value, this._fragmentStart - 1 /* # */))
   }
 
   toString() {
@@ -233,18 +257,32 @@ class URL {
   }
 
   _parse(input, base, shouldThrow) {
+    let href
+
     try {
-      this._href = binding.parse(
-        String(input),
-        base ? String(base) : null,
-        this._components,
-        shouldThrow
-      )
+      href = binding.parse(input, base || null, components, shouldThrow)
     } catch (err) {
       if (err instanceof TypeError) throw err
 
       throw errors.INVALID_URL(`Invalid URL '${input}'`, input)
     }
+
+    if (href === undefined) return
+
+    this._href = href
+    this._schemeEnd = components[0]
+    this._usernameEnd = components[1]
+    this._hostStart = components[2]
+    this._hostEnd = components[3]
+    this._pathStart = components[5]
+
+    const queryStart = components[6]
+    const fragmentStart = components[7]
+
+    const end = href.length + 1
+
+    this._queryStart = queryStart === unset ? end : queryStart
+    this._fragmentStart = fragmentStart === unset ? end : fragmentStart
   }
 
   _update(input) {
@@ -301,27 +339,35 @@ exports.fileURLToPath = function fileURLToPath(url) {
     throw errors.INVALID_URL_SCHEME('The URL must use the file: protocol')
   }
 
-  if (isWindows) {
-    if (/%2f|%5c/i.test(url.pathname)) {
-      throw errors.INVALID_FILE_URL_PATH(
-        'The file: URL path must not include encoded \\ or / characters'
-      )
-    }
-  } else {
-    if (url.hostname) {
-      throw errors.INVALID_FILE_URL_HOST("The file: URL host must be 'localhost' or empty")
-    }
+  if (!isWindows && url.hostname) {
+    throw errors.INVALID_FILE_URL_HOST("The file: URL host must be 'localhost' or empty")
+  }
+
+  const encoded = url.pathname
 
-    if (/%2f/i.test(url.pathname)) {
+  // Every check below looks for a percent encoded sequence, as does the decoding
+  // that follows, so a path without any can skip all of them.
+  const hasEncoded = encoded.includes('%')
+
+  if (hasEncoded) {
+    if (isWindows) {
+      if (/%2f|%5c/i.test(encoded)) {
+        throw errors.INVALID_FILE_URL_PATH(
+          'The file: URL path must not include encoded \\ or / characters'
+        )
+      }
+    } else if (/%2f/i.test(encoded)) {
       throw errors.INVALID_FILE_URL_PATH('The file: URL path must not include encoded / characters')
     }
-  }
 
-  if (/%00/i.test(url.pathname)) {
-    throw errors.INVALID_FILE_URL_PATH('The file: URL path must not include encoded NUL characters')
+    if (/%00/i.test(encoded)) {
+      throw errors.INVALID_FILE_URL_PATH(
+        'The file: URL path must not include encoded NUL characters'
+      )
+    }
   }
 
-  const pathname = path.normalize(decodeURIComponent(url.pathname))
+  const pathname = path.normalize(hasEncoded ? decodeURIComponent(encoded) : encoded)
 
   if (isWindows) {
     if (url.hostname) return '\\\\' + url.hostname + pathname
@@ -347,16 +393,20 @@ exports.pathToFileURL = function pathToFileURL(pathname) {
     resolved += '\\'
   }
 
-  resolved = resolved
-    .replaceAll('%', '%25') // Must be first
-    .replaceAll('#', '%23')
-    .replaceAll('?', '%3f')
-    .replaceAll('\n', '%0a')
-    .replaceAll('\r', '%0d')
-    .replaceAll('\t', '%09')
+  // Paths hardly ever contain any of these, so one pass to rule them out is
+  // cheaper than the six or seven replacements it stands in for.
+  if (reserved.test(resolved)) {
+    resolved = resolved
+      .replaceAll('%', '%25') // Must be first
+      .replaceAll('#', '%23')
+      .replaceAll('?', '%3f')
+      .replaceAll('\n', '%0a')
+      .replaceAll('\r', '%0d')
+      .replaceAll('\t', '%09')
 
-  if (!isWindows) {
-    resolved = resolved.replaceAll('\\', '%5c')
+    if (!isWindows) {
+      resolved = resolved.replaceAll('\\', '%5c')
+    }
   }
 
   return new URL('file:' + resolved)

package/lib/url-search-params.js

@@ -1,5 +1,3 @@
-const binding = require('../binding')
-
 const kind = Symbol.for('bare.url.search-params.kind')
 
 class URLSearchParams {
@@ -11,17 +9,21 @@ class URLSearchParams {
 
   // https://url.spec.whatwg.org/#dom-urlsearchparams-urlsearchparams
   constructor(init, url = null) {
-    this._params = new Map()
+    this._params = null
 
     if (url) URLSearchParams._urls.set(this, url)
 
     if (typeof init === 'string') {
       this._parse(init)
-    } else if (init) {
-      for (const [name, value] of typeof init[Symbol.iterator] === 'function'
-        ? init
-        : Object.entries(init)) {
-        this.append(name, value)
+    } else {
+      this._params = new Map()
+
+      if (init) {
+        for (const [name, value] of typeof init[Symbol.iterator] === 'function'
+          ? init
+          : Object.entries(init)) {
+          this.append(name, value)
+        }
       }
     }
   }
@@ -147,41 +149,51 @@ class URLSearchParams {
 
   // https://url.spec.whatwg.org/#concept-urlencoded-parser
   _parse(input) {
-    if (input[0] === '?') input = input.substring(1)
+    const params = new Map()
 
-    this._params = new Map()
+    this._params = params
 
-    for (let sequence of input.split('&')) {
-      if (sequence.length === 0) continue
+    const len = input.length
 
-      sequence = sequence.replace(/\+/g, ' ')
+    let start = input.charCodeAt(0) === 0x3f /* ? */ ? 1 : 0
 
-      let i = sequence.indexOf('=')
-      if (i === -1) i = sequence.length
+    while (start < len) {
+      let end = input.indexOf('&', start)
+      if (end === -1) end = len
 
-      const name = decodeURIComponent(sequence.substring(0, i))
-      const value = decodeURIComponent(sequence.substring(i + 1, sequence.length))
+      if (end !== start) {
+        let split = input.indexOf('=', start)
+        if (split === -1 || split > end) split = end
 
-      let list = this._params.get(name)
+        const name = decode(input.slice(start, split))
+        const value = split === end ? '' : decode(input.slice(split + 1, end))
+
+        const list = params.get(name)
 
-      if (list === undefined) {
-        list = []
-        this._params.set(name, list)
+        if (list === undefined) params.set(name, [value])
+        else list.push(value)
       }
 
-      list.push(value)
+      start = end + 1
     }
   }
 
   // https://url.spec.whatwg.org/#concept-urlencoded-serializer
   _serialize() {
-    const pairs = []
+    let result = ''
+    let separator = ''
 
     for (const [name, values] of this._params) {
-      for (const value of values) pairs.push(String(name), String(value))
+      // The name is shared by all of its values, so it is only encoded once.
+      const encoded = encode(String(name))
+
+      for (const value of values) {
+        result += separator + encoded + '=' + encode(String(value))
+        separator = '&'
+      }
     }
 
-    return binding.serializeSearchParams(pairs)
+    return result
   }
 }
 
@@ -192,3 +204,66 @@ exports.isURLSearchParams = function isURLSearchParams(value) {
 
   return typeof value === 'object' && value !== null && value[kind] === URLSearchParams[kind]
 }
+
+// https://url.spec.whatwg.org/#concept-urlencoded-byte-serializer
+//
+// Everything except ASCII alphanumerics and `*-._` is percent-encoded, and a
+// space becomes `+` rather than `%20`. Names and values usually consist entirely
+// of characters that are left alone, so a component is tested as a whole before
+// any of it is rewritten.
+const unencoded = /^[\w*.-]*$/
+
+// As above, but allowing spaces, which need nothing more than turning into `+`.
+// Spaces are by far the most common reason for a component to need rewriting at
+// all, so recognizing them here spares those components a trip through
+// encodeURIComponent().
+const spaced = /^[\w*. -]*$/
+
+// The characters that encodeURIComponent() leaves alone but the urlencoded byte
+// serializer does not. Two patterns are needed because a global regular
+// expression cannot be shared between test() and replace(), as test() advances
+// its lastIndex.
+const extra = /[!'()~]/
+const extraAll = /[!'()~]/g
+
+const escapes = {
+  '!': '%21',
+  "'": '%27',
+  '(': '%28',
+  ')': '%29',
+  '~': '%7E'
+}
+
+// A surrogate that is not part of a pair, and so does not encode a scalar value.
+const lone = /[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/g
+
+function encode(component) {
+  if (unencoded.test(component)) return component
+
+  if (spaced.test(component)) return component.replaceAll(' ', '+')
+
+  let encoded
+
+  try {
+    encoded = encodeURIComponent(component)
+  } catch {
+    // encodeURIComponent() rejects lone surrogates, whereas the UTF-8 encoder the
+    // serializer is defined in terms of replaces them with U+FFFD.
+    encoded = encodeURIComponent(component.replace(lone, '\ufffd'))
+  }
+
+  if (encoded.includes('%20')) encoded = encoded.replaceAll('%20', '+')
+
+  if (extra.test(encoded)) encoded = encoded.replace(extraAll, (match) => escapes[match])
+
+  return encoded
+}
+
+// https://url.spec.whatwg.org/#percent-decode-after-encoding
+function decode(component) {
+  if (component.indexOf('+') !== -1) component = component.replaceAll('+', ' ')
+
+  if (component.indexOf('%') === -1) return component
+
+  return decodeURIComponent(component)
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bare-url",
-  "version": "2.5.1",
+  "version": "2.5.2",
   "description": "WHATWG URL implementation for JavaScript",
   "exports": {
     "./package": "./package.json",