bare-url 2.5.3 → 2.5.5

package/README.md

@@ -28,6 +28,10 @@ require('bare-url/global')
 
 See the [`bare-url` reference](https://docs.pears.com/reference/bare/modules/bare-url).
 
+## Threat model
+
+`bare-url` is one of the addons Bare compiles into its binary, so it inherits [Bare's threat model](https://github.com/holepunchto/bare/blob/main/docs/threat-model.md). See [`docs/threat-model.md`](docs/threat-model.md) for where this addon sits in it.
+
 ## License
 
 Apache-2.0

package/binding.c

@@ -193,6 +193,11 @@ bare_url__read_string(js_env_t *env, js_value_t *value, utf8_t *stack, size_t st
     buffer = result->heap = malloc(utf8_len);
 
     if (buffer == NULL) {
+      err = js_release_string_view(env, result->view);
+      assert(err == 0);
+
+      result->view = NULL;
+
       err = js_throw_error(env, uv_err_name(UV_ENOMEM), uv_strerror(UV_ENOMEM));
       assert(err == 0);
 

package/index.d.ts

@@ -87,6 +87,9 @@ declare namespace URL {
   /**
    * Convert a platform-specific file path to a `file:` URL.
    * @param pathname - The platform-specific file path to convert.
+   * @throws {INVALID_ARG_VALUE} (Windows) the path is a UNC path with an empty server name or
+   * no resource path.
+   * @throws {INVALID_URL} the path does not form a valid `file:` URL.
    */
   export function pathToFileURL(pathname: string): URL
 

package/index.js

@@ -494,6 +494,26 @@ function encodePath(value) {
   return value.replace(pathDelimiterAll, (match) => escapes[match])
 }
 
+function encodeFilePath(value) {
+  // Paths hardly ever contain any of these, so one pass to rule them out is
+  // cheaper than the six or seven replacements it stands in for.
+  if (!reserved.test(value)) return value
+
+  value = value
+    .replaceAll('%', '%25') // Must be first
+    .replaceAll('#', '%23')
+    .replaceAll('?', '%3f')
+    .replaceAll('\n', '%0a')
+    .replaceAll('\r', '%0d')
+    .replaceAll('\t', '%09')
+
+  if (!isWindows) {
+    value = value.replaceAll('\\', '%5c')
+  }
+
+  return value
+}
+
 function encodeQuery(value) {
   if (value.indexOf('#') === -1) return value
 
@@ -600,7 +620,27 @@ exports.fileURLToPath = function fileURLToPath(url) {
 }
 
 exports.pathToFileURL = function pathToFileURL(pathname) {
-  let resolved = path.resolve(pathname)
+  const isUNC = isWindows && pathname.startsWith('\\\\')
+
+  let resolved = isUNC ? pathname : path.resolve(pathname)
+
+  if (isUNC || (isWindows && resolved.startsWith('\\\\'))) {
+    // https://learn.microsoft.com/en-us/windows/win32/fileio/maximum-file-path-limitation
+    const hostStart = resolved.startsWith('\\\\?\\UNC\\') ? 8 : 2
+    const hostEnd = resolved.indexOf('\\', hostStart)
+
+    if (hostEnd === -1) {
+      throw errors.INVALID_ARG_VALUE('Missing UNC resource path')
+    }
+
+    if (hostEnd === 2) {
+      throw errors.INVALID_ARG_VALUE('Empty UNC servername')
+    }
+
+    const hostname = truncateHost('file', resolved.slice(hostStart, hostEnd))
+
+    return new URL('file://' + hostname + encodeFilePath(resolved.slice(hostEnd)))
+  }
 
   if (pathname[pathname.length - 1] === '/') {
     resolved += '/'
@@ -608,23 +648,7 @@ exports.pathToFileURL = function pathToFileURL(pathname) {
     resolved += '\\'
   }
 
-  // Paths hardly ever contain any of these, so one pass to rule them out is
-  // cheaper than the six or seven replacements it stands in for.
-  if (reserved.test(resolved)) {
-    resolved = resolved
-      .replaceAll('%', '%25') // Must be first
-      .replaceAll('#', '%23')
-      .replaceAll('?', '%3f')
-      .replaceAll('\n', '%0a')
-      .replaceAll('\r', '%0d')
-      .replaceAll('\t', '%09')
-
-    if (!isWindows) {
-      resolved = resolved.replaceAll('\\', '%5c')
-    }
-  }
-
-  return new URL('file:' + resolved)
+  return new URL('file:' + encodeFilePath(resolved))
 }
 
 exports.format = function format(parts) {

package/lib/errors.js

@@ -30,4 +30,8 @@ module.exports = class URLError extends Error {
   static INVALID_FILE_URL_PATH(msg = 'Invalid file: URL path') {
     return new URLError(msg, URLError.INVALID_FILE_URL_PATH)
   }
+
+  static INVALID_ARG_VALUE(msg = 'Invalid argument value') {
+    return new URLError(msg, URLError.INVALID_ARG_VALUE)
+  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bare-url",
-  "version": "2.5.3",
+  "version": "2.5.5",
   "description": "WHATWG URL implementation for JavaScript",
   "exports": {
     "./package": "./package.json",