fast-uri 2.4.2 → 2.4.4

package/.github/workflows/ci.yml

@@ -17,6 +17,9 @@ on:
 
 jobs:
   test:
+    permissions:
+      contents: write
+      pull-requests: write
     uses: fastify/workflows/.github/workflows/plugins-ci.yml@v3
     with:
       license-check: true

package/index.js

@@ -14,7 +14,12 @@ function normalize (uri, options) {
 
 function resolve (baseURI, relativeURI, options) {
   const schemelessOptions = Object.assign({ scheme: 'null' }, options)
-  const resolved = resolveComponents(parse(baseURI, schemelessOptions), parse(relativeURI, schemelessOptions), schemelessOptions, true)
+  const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions)
+  const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions)
+  if (baseMalformed || relativeMalformed) {
+    throw new Error(baseParsed.error || relativeParsed.error || 'URI is malformed.')
+  }
+  const resolved = resolveComponents(baseParsed, relativeParsed, schemelessOptions, true)
   return serialize(resolved, { ...schemelessOptions, skipEscape: true })
 }
 
@@ -181,6 +186,19 @@ function nonSimpleDomain (value) {
 
 const URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u
 
+// Captures the authority component (between "//" and the next "/", "?" or "#"),
+// with or without a scheme prefix, for the literal-backslash rejection below.
+const AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/
+
+// Captures the leading authority-introducer region after an optional scheme: a
+// run of forward slashes, backslashes, and the characters the WHATWG URL parser
+// removes before parsing (TAB U+0009, LF U+000A, CR U+000D). A valid introducer
+// is exactly "//". Node treats "\\" as "/" on special schemes and strips those
+// characters first, so forms like "\\", "/\", "\/", "/<TAB>/", or a leading
+// "<TAB>//" reach an authority in Node while fast-uri's URI_PARSE folds them into
+// the path group (host confusion / SSRF / redirect bypass).
+const AUTHORITY_INTRODUCER_REGION = /^(?:[^#/:?]+:)?([/\\\t\n\r]*)/
+
 function getParseError (parsed, matches) {
   if (matches[2] !== undefined && parsed.path && parsed.path[0] !== '/') {
     return 'URI path must start with "/" when authority is present.'
@@ -209,6 +227,41 @@ function parseWithStatus (uri, opts) {
   let isIP = false
   if (options.reference === 'suffix') uri = (options.scheme ? options.scheme + ':' : '') + '//' + uri
 
+  // A literal backslash (U+005C) is not a valid RFC 3986 URI character and is
+  // not an authority delimiter. Reject it in the authority rather than
+  // rewriting it: normalizing "\" -> "/" (WHATWG error recovery) could silently
+  // change the resource identified by an otherwise-invalid input, and lets "\"
+  // act as a host delimiter here while Node's native URL parses a different
+  // host (SSRF / redirect / origin-allowlist bypass). Percent-encoded %5C is
+  // untouched and remains valid encoded data.
+  const authorityMatch = uri.match(AUTHORITY_PREFIX)
+  if (authorityMatch !== null && authorityMatch[1].indexOf('\\') !== -1) {
+    parsed.error = 'URI authority must not contain a literal backslash.'
+    malformedAuthorityOrPort = true
+  }
+
+  // Reject a malformed or whitespace-smuggled authority introducer. fast-uri
+  // only recognizes a literal "//"; anything else in the leading separator run
+  // (a backslash, or a "//" that appears only after removing the TAB/LF/CR that
+  // Node strips) means the authority fast-uri parses differs from the one Node's
+  // URL resolves. Reject rather than rewrite, mirroring the literal-backslash
+  // guard above. Percent-encoded forms (%5C, %09) are untouched, valid data.
+  const introducerMatch = uri.match(AUTHORITY_INTRODUCER_REGION)
+  if (introducerMatch !== null) {
+    const region = introducerMatch[1]
+    const normalizedRegion = region.replace(/[\t\n\r]/g, '')
+    // Two or more leading separators introduce an authority.
+    if (normalizedRegion.length >= 2) {
+      if (normalizedRegion.slice(0, 2) !== '//') {
+        parsed.error = parsed.error || 'URI authority must not contain a literal backslash.'
+        malformedAuthorityOrPort = true
+      } else if (region.length !== normalizedRegion.length) {
+        parsed.error = parsed.error || 'URI authority introducer must not contain whitespace.'
+        malformedAuthorityOrPort = true
+      }
+    }
+  }
+
   const matches = uri.match(URI_PARSE)
 
   if (matches) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fast-uri",
   "description": "Dependency free RFC 3986 URI toolbox",
-  "version": "2.4.2",
+  "version": "2.4.4",
   "main": "index.js",
   "type": "commonjs",
   "types": "types/index.d.ts",

package/test/security.test.js

@@ -160,3 +160,201 @@ test('parse canonicalises IDN / Unicode hosts to their ASCII form', (t) => {
     t.equal(parsed.host, expectedHost, `host canonicalised to ASCII: ${description}`)
   })
 })
+
+test('parse rejects a literal backslash in the authority as malformed (RFC 3986)', (t) => {
+  // Regression for the host-confusion bypass: a literal "\" is invalid RFC 3986
+  // syntax and must be flagged malformed, not silently rewritten. Otherwise "\"
+  // acts as a host delimiter here while Node's native URL parses a different
+  // host, defeating a host-based SSRF/redirect/origin allowlist.
+  const cases = [
+    'http://evil.com\\@allowed.com',
+    'https://169.254.169.254\\@trusted.example.com',
+    'http://127.0.0.1\\@public.example.com',
+    'https://attacker.com\\@api.internal',
+    'http://a\\@b',
+    'ws://evil.com\\@allowed.com/chat',
+    'wss://evil.com\\@allowed.com/chat',
+    'http://evil.com\\%40allowed.com',
+    '//evil.com\\@allowed.com'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    t.equal(
+      fastURI.parse(input).error,
+      'URI authority must not contain a literal backslash.',
+      input
+    )
+  })
+})
+
+test('normalize does not canonicalize a literal-backslash URI into a different valid URL', (t) => {
+  const cases = [
+    'http://evil.com\\@allowed.com',
+    'https://attacker.com\\@api.internal'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    t.equal(fastURI.normalize(input), input, input)
+  })
+})
+
+test('parse leaves percent-encoded %5C untouched as encoded data (not rejected)', (t) => {
+  // Only the literal "\" byte is rejected; %5C stays valid encoded data and
+  // does not diverge from the native URL parser, so it must not be flagged.
+  const input = 'http://evil.com%5C@allowed.com'
+  const parsed = fastURI.parse(input)
+
+  t.plan(2)
+  t.notOk(parsed.error, '%5C is valid encoded data, not malformed')
+  t.equal(parsed.host, new URL(input).hostname, '%5C host matches native URL (no divergence)')
+})
+
+test('parse does not reject a literal backslash in the query or fragment', (t) => {
+  // The rejection is scoped to the authority/path (the host-confusion surface);
+  // a backslash after "?"/"#" is normalized as encoded data as before.
+  const parsed = fastURI.parse('http://host.example.com/?x=\\y#z\\w')
+
+  t.plan(2)
+  t.notOk(parsed.error, 'backslash in query/fragment does not mark the URI malformed')
+  t.equal(parsed.host, 'host.example.com', 'host parsed normally')
+})
+
+test('parse rejects a malformed authority introducer (\\\\, /\\, \\/) in place of //', (t) => {
+  // Regression: "\\", "/\\", "\\/" after the scheme colon are not valid authority
+  // introducers. Node's URL treats "\\" as interchangeable with "/" on special
+  // schemes, so "http:\\\\evil.com/path" would be parsed as host "evil.com" by
+  // Node, but fast-uri must reject it as malformed to prevent SSRF/redirect bypass.
+  const cases = [
+    'http:\\\\evil.com/path',
+    'http:/\\evil.com/path',
+    'http:\\/evil.com/path',
+    'ws:\\\\evil.com/chat',
+    'wss:\\\\evil.com/chat',
+    'ftp:\\\\evil.com/',
+    '\\\\evil.com/path'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    t.equal(
+      fastURI.parse(input).error,
+      'URI authority must not contain a literal backslash.',
+      input
+    )
+  })
+})
+
+test('normalize does not canonicalize a malformed-authority-introducer URI', (t) => {
+  const cases = [
+    'http:\\\\evil.com/path',
+    'http:/\\evil.com/path'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    t.equal(fastURI.normalize(input), input, input)
+  })
+})
+
+test('equal returns false for malformed-authority-introducer URIs', (t) => {
+  const pairs = [
+    ['http:\\\\evil.com/path', 'http://evil.com/path'],
+    ['http:/\\evil.com/path', 'http://evil.com/path']
+  ]
+
+  t.plan(pairs.length)
+
+  pairs.forEach(([left, right]) => {
+    t.equal(fastURI.equal(left, right), false, `${left} != ${right}`)
+  })
+})
+
+test('resolve throws on malformed authority introducer', (t) => {
+  // resolve() returns a plain string with no error field, so the only safe
+  // behavior is to throw when either component has a malformed authority.
+  const pairs = [
+    ['https://allowed.com/', '\\\\evil.com/path'],
+    ['\\\\evil.com/path', 'https://allowed.com/'],
+    ['https://allowed.com/', 'http:/\\evil.com/path'],
+    ['https://allowed.com/', 'http:\\/evil.com/path']
+  ]
+
+  t.plan(pairs.length)
+
+  pairs.forEach(([base, rel]) => {
+    t.throws(
+      () => fastURI.resolve(base, rel),
+      /URI authority must not contain a literal backslash/,
+      `${base} + ${rel}`
+    )
+  })
+})
+
+test('parse rejects a whitespace-split authority introducer (TAB, LF, CR)', (t) => {
+  // The WHATWG URL parser removes TAB (U+0009), LF (U+000A) and CR (U+000D) from
+  // the input before parsing, so a stripped character wedged into the introducer
+  // ("/<TAB>\\", "/<TAB>/", or a leading "<TAB>//") reaches an authority in Node
+  // while fast-uri would otherwise fold it into the path. These must be rejected
+  // like the adjacent "\\", "/\\", "\\/" forms.
+  const cases = [
+    { input: '/\t\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: '/\t/evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' },
+    { input: '/\n\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: '/\r\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: '\t//evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' },
+    { input: '\t/\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: 'https:/\t/evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' }
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach(({ input, expectedError }) => {
+    t.equal(fastURI.parse(input).error, expectedError, JSON.stringify(input))
+  })
+})
+
+test('resolve throws on a whitespace-split authority introducer', (t) => {
+  const pairs = [
+    ['https://allowed.com/', '/\t\\evil.com/path'],
+    ['https://allowed.com/', '/\t/evil.com/path'],
+    ['https://allowed.com/', '/\n\\evil.com/path'],
+    ['/\t/evil.com/path', 'https://allowed.com/']
+  ]
+
+  t.plan(pairs.length)
+
+  pairs.forEach(([base, rel]) => {
+    t.throws(
+      () => fastURI.resolve(base, rel),
+      /URI authority (must not contain a literal backslash|introducer must not contain whitespace)/,
+      `${JSON.stringify(base)} + ${JSON.stringify(rel)}`
+    )
+  })
+})
+
+test('parse does not reject valid authority introducer patterns', (t) => {
+  // No false positives: "//" introducer and scheme-less "//" must be valid.
+  const cases = [
+    'http://good.com/',
+    'https://good.com/',
+    'ws://good.com/chat',
+    'wss://good.com/chat',
+    'ftp://good.com/',
+    '//good.com/path',
+    '/absolute/path',
+    'relative/path'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    const parsed = fastURI.parse(input)
+    t.notOk(parsed.error, input)
+  })
+})