fast-uri 2.4.3 → 2.4.5

package/test/security-normalization.test.js

@@ -1,7 +1,6 @@
 'use strict'
 
-const tap = require('tap')
-const test = tap.test
+const test = require('tape')
 const fastURI = require('..')
 
 test('parse preserves reserved path escapes as data', (t) => {
@@ -38,3 +37,104 @@ test('equal does not treat reserved path escapes as live path syntax', (t) => {
 
   t.end()
 })
+
+test('serialize preserves literal RFC 3986 reserved path characters', (t) => {
+  // GHSA-7mh8-fcmq-x23c: literal reserved path chars must not be rewritten to
+  // percent escapes by the escape()-style safe set.
+  const cases = [
+    'http://example.com/a;b',
+    'http://example.com/a=b',
+    'http://example.com/a&b',
+    'http://example.com/a$b',
+    'http://example.com/a:b',
+    'http://example.com/a@b'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((uri) => {
+    t.equal(fastURI.serialize(fastURI.parse(uri)), uri, uri)
+  })
+  t.end()
+})
+
+test('serialize preserves existing reserved path escapes as data', (t) => {
+  // GHSA-7mh8-fcmq-x23c: an existing %3A escape must stay %3A instead of being
+  // rewritten into a live colon.
+  const cases = [
+    'http://example.com/a%3Ab',
+    'http://example.com/a%3Bb',
+    'http://example.com/a%3D%3D'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((uri) => {
+    t.equal(fastURI.serialize(fastURI.parse(uri)), uri, uri)
+  })
+  t.end()
+})
+
+test('serialize keeps path-noscheme colon escaping', (t) => {
+  // Without a scheme a literal colon would be reparsed as a scheme separator,
+  // so it must stay percent-escaped while an existing %3A is preserved.
+  t.equal(fastURI.serialize({ path: 'foo:bar' }), 'foo%3Abar')
+  t.equal(fastURI.serialize({ path: 'a%3Ab' }), 'a%3Ab')
+  t.end()
+})
+
+test('hostname normalization never decodes an escape more than once', (t) => {
+  const encodedLocalhost = 'http://%256c%256f%2563%2561%256c%2568%256f%2573%2574/'
+  const encodedLoopback = '//127%252e0%252e0%252e1/private'
+  const encodedMetadataAddress = '//169%252E254%252E169%252E254/latest/meta-data/'
+
+  t.equal(fastURI.normalize(encodedLocalhost), encodedLocalhost, 'nested hostname letters remain encoded')
+  t.equal(fastURI.normalize(encodedLoopback), encodedLoopback, 'nested IPv4 dots remain encoded')
+  t.equal(
+    fastURI.resolve('https://safe.example/', encodedLoopback),
+    'https://127%252e0%252e0%252e1/private',
+    'resolve does not turn nested dots into a loopback address'
+  )
+  t.equal(
+    fastURI.resolve('https://allowed.com/api/v1/', encodedMetadataAddress),
+    'https://169%252e254%252e169%252e254/latest/meta-data/',
+    'resolve does not turn nested dots into a metadata address'
+  )
+  t.equal(
+    fastURI.normalize('http://allowed.com%255Cevil.com/'),
+    'http://allowed.com%255Cevil.com/',
+    'normalize does not activate a nested backslash'
+  )
+  t.equal(
+    fastURI.serialize({ scheme: 'http', host: '%256cocalhost', path: '/' }),
+    'http://%256cocalhost/',
+    'component serialization preserves an encoded percent sign'
+  )
+  t.equal(
+    fastURI.equal(encodedLocalhost, 'http://localhost/', {}),
+    false,
+    'nested escapes do not compare equal to their twice-decoded target'
+  )
+  t.end()
+})
+
+test('hostname normalization decodes only current unreserved escapes', (t) => {
+  t.equal(fastURI.normalize('x://%6cocalhost/'), 'x://localhost/', 'a current unreserved escape is decoded')
+  t.equal(fastURI.normalize('x://%256cocalhost/'), 'x://%256cocalhost/', 'an encoded percent is preserved')
+  t.equal(fastURI.normalize('x://host%2540evil/'), 'x://host%2540evil/', 'a nested authority delimiter stays inert')
+  t.equal(fastURI.normalize('x://%2525/'), 'x://%2525/', 'nested encoded percent signs stay encoded')
+  t.end()
+})
+
+test('host conversion failures are not treated as comparable URLs', (t) => {
+  const malformedHost = 'http://trusted.test%2540evil.test/'
+
+  t.equal(fastURI.normalize(malformedHost), malformedHost, 'normalization preserves the failing input')
+  t.equal(fastURI.equal(malformedHost, malformedHost, {}), false, 'equal rejects a failed host conversion')
+  t.throws(
+    () => fastURI.resolve(malformedHost, 'child', { domainHost: true }),
+    /Host's domain name can not be converted to ASCII/,
+    'resolve propagates a host conversion failure'
+  )
+  t.end()
+})

package/test/security.test.js

@@ -1,7 +1,6 @@
 'use strict'
 
-const tap = require('tap')
-const test = tap.test
+const test = require('tape')
 const fastURI = require('..')
 
 test('parse marks malformed authority and port inputs as errors', (t) => {
@@ -114,7 +113,7 @@ test('resolve preserves encoded authority delimiters', (t) => {
   const parsed = fastURI.parse(result)
 
   t.plan(1)
-  t.not(parsed.host, 'evil.com', '//trusted.com%40evil.com/path')
+  t.notEqual(parsed.host, 'evil.com', '//trusted.com%40evil.com/path')
 })
 
 test('serialize escapes authority delimiters in host field', (t) => {
@@ -122,15 +121,17 @@ test('serialize escapes authority delimiters in host field', (t) => {
   const parsed = fastURI.parse(result)
 
   t.plan(1)
-  t.not(parsed.host, 'evil.com', 'host: trusted.com@evil.com')
+  t.notEqual(parsed.host, 'evil.com', 'host: trusted.com@evil.com')
 })
 
 test('normalize does not double-decode %2540 into a live @', (t) => {
-  const result = fastURI.normalize('http://trusted.com%2540evil.com/')
+  const input = 'http://trusted.com%2540evil.com/'
+  const result = fastURI.normalize(input)
   const parsed = fastURI.parse(result)
 
-  t.plan(1)
-  t.not(parsed.host, 'trusted.com@evil.com', 'http://trusted.com%2540evil.com/')
+  t.plan(2)
+  t.equal(result, input, 'the encoded percent sign is preserved')
+  t.notEqual(parsed.host, 'trusted.com@evil.com', input)
 })
 
 test('parse canonicalises IDN / Unicode hosts to their ASCII form', (t) => {
@@ -161,6 +162,76 @@ test('parse canonicalises IDN / Unicode hosts to their ASCII form', (t) => {
   })
 })
 
+test('resolve canonicalises the host using the final resolved scheme', (t) => {
+  const cases = [
+    {
+      base: 'http://trusted.example/base',
+      relative: '//127\u30020\u30020\u30021/private',
+      expected: 'http://127.0.0.1/private',
+      expectedHost: '127.0.0.1',
+      description: 'scheme-relative loopback host'
+    },
+    {
+      base: 'https://ex\u00ADample.com/base',
+      relative: 'child',
+      expected: 'https://example.com/child',
+      expectedHost: 'example.com',
+      description: 'host inherited from the base'
+    },
+    {
+      base: 'http://trusted.example/base',
+      relative: 'http://ex\u200Bample.com/',
+      expected: 'http://example.com/',
+      expectedHost: 'example.com',
+      description: 'absolute relative reference'
+    }
+  ]
+
+  t.plan(cases.length * 2)
+
+  cases.forEach(({ base, relative, expected, expectedHost, description }) => {
+    const resolved = fastURI.resolve(base, relative)
+    t.equal(resolved, expected, description)
+    t.equal(fastURI.parse(resolved).host, expectedHost, `${description} reparses consistently`)
+  })
+})
+
+test('resolve applies domain canonicalisation only when the effective scheme opts in', (t) => {
+  const host = 'ex\u00ADample.com'
+
+  t.plan(2)
+  t.equal(
+    fastURI.resolve('uri://trusted.example/', `//${host}/`),
+    `uri://${host}/`,
+    'an unsupported scheme preserves the host'
+  )
+  t.equal(
+    fastURI.resolve('http://trusted.example/', `//${host}/`, { unicodeSupport: true }),
+    `http://${host}/`,
+    'unicodeSupport preserves the Unicode host'
+  )
+})
+
+test('resolve throws when the final scheme cannot canonicalise the host', (t) => {
+  const invalidHost = '\u200D.example'
+  const cases = [
+    ['http://trusted.example/', `//${invalidHost}/`],
+    [`https://${invalidHost}/base`, 'child'],
+    ['http://trusted.example/', `http://${invalidHost}/`],
+    ['http://trusted.example/', `//${invalidHost}%2Etest/`]
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach(([base, relative]) => {
+    t.throws(
+      () => fastURI.resolve(base, relative),
+      /Host's domain name can not be converted to ASCII/,
+      `${base} + ${relative}`
+    )
+  })
+})
+
 test('parse rejects a literal backslash in the authority as malformed (RFC 3986)', (t) => {
   // Regression for the host-confusion bypass: a literal "\" is invalid RFC 3986
   // syntax and must be flagged malformed, not silently rewritten. Otherwise "\"
@@ -222,3 +293,139 @@ test('parse does not reject a literal backslash in the query or fragment', (t) =
   t.notOk(parsed.error, 'backslash in query/fragment does not mark the URI malformed')
   t.equal(parsed.host, 'host.example.com', 'host parsed normally')
 })
+
+test('parse rejects a malformed authority introducer (\\\\, /\\, \\/) in place of //', (t) => {
+  // Regression: "\\", "/\\", "\\/" after the scheme colon are not valid authority
+  // introducers. Node's URL treats "\\" as interchangeable with "/" on special
+  // schemes, so "http:\\\\evil.com/path" would be parsed as host "evil.com" by
+  // Node, but fast-uri must reject it as malformed to prevent SSRF/redirect bypass.
+  const cases = [
+    'http:\\\\evil.com/path',
+    'http:/\\evil.com/path',
+    'http:\\/evil.com/path',
+    'ws:\\\\evil.com/chat',
+    'wss:\\\\evil.com/chat',
+    'ftp:\\\\evil.com/',
+    '\\\\evil.com/path'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    t.equal(
+      fastURI.parse(input).error,
+      'URI authority must not contain a literal backslash.',
+      input
+    )
+  })
+})
+
+test('normalize does not canonicalize a malformed-authority-introducer URI', (t) => {
+  const cases = [
+    'http:\\\\evil.com/path',
+    'http:/\\evil.com/path'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    t.equal(fastURI.normalize(input), input, input)
+  })
+})
+
+test('equal returns false for malformed-authority-introducer URIs', (t) => {
+  const pairs = [
+    ['http:\\\\evil.com/path', 'http://evil.com/path'],
+    ['http:/\\evil.com/path', 'http://evil.com/path']
+  ]
+
+  t.plan(pairs.length)
+
+  pairs.forEach(([left, right]) => {
+    t.equal(fastURI.equal(left, right), false, `${left} != ${right}`)
+  })
+})
+
+test('resolve throws on malformed authority introducer', (t) => {
+  // resolve() returns a plain string with no error field, so the only safe
+  // behavior is to throw when either component has a malformed authority.
+  const pairs = [
+    ['https://allowed.com/', '\\\\evil.com/path'],
+    ['\\\\evil.com/path', 'https://allowed.com/'],
+    ['https://allowed.com/', 'http:/\\evil.com/path'],
+    ['https://allowed.com/', 'http:\\/evil.com/path']
+  ]
+
+  t.plan(pairs.length)
+
+  pairs.forEach(([base, rel]) => {
+    t.throws(
+      () => fastURI.resolve(base, rel),
+      /URI authority must not contain a literal backslash/,
+      `${base} + ${rel}`
+    )
+  })
+})
+
+test('parse rejects a whitespace-split authority introducer (TAB, LF, CR)', (t) => {
+  // The WHATWG URL parser removes TAB (U+0009), LF (U+000A) and CR (U+000D) from
+  // the input before parsing, so a stripped character wedged into the introducer
+  // ("/<TAB>\\", "/<TAB>/", or a leading "<TAB>//") reaches an authority in Node
+  // while fast-uri would otherwise fold it into the path. These must be rejected
+  // like the adjacent "\\", "/\\", "\\/" forms.
+  const cases = [
+    { input: '/\t\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: '/\t/evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' },
+    { input: '/\n\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: '/\r\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: '\t//evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' },
+    { input: '\t/\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: 'https:/\t/evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' }
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach(({ input, expectedError }) => {
+    t.equal(fastURI.parse(input).error, expectedError, JSON.stringify(input))
+  })
+})
+
+test('resolve throws on a whitespace-split authority introducer', (t) => {
+  const pairs = [
+    ['https://allowed.com/', '/\t\\evil.com/path'],
+    ['https://allowed.com/', '/\t/evil.com/path'],
+    ['https://allowed.com/', '/\n\\evil.com/path'],
+    ['/\t/evil.com/path', 'https://allowed.com/']
+  ]
+
+  t.plan(pairs.length)
+
+  pairs.forEach(([base, rel]) => {
+    t.throws(
+      () => fastURI.resolve(base, rel),
+      /URI authority (must not contain a literal backslash|introducer must not contain whitespace)/,
+      `${JSON.stringify(base)} + ${JSON.stringify(rel)}`
+    )
+  })
+})
+
+test('parse does not reject valid authority introducer patterns', (t) => {
+  // No false positives: "//" introducer and scheme-less "//" must be valid.
+  const cases = [
+    'http://good.com/',
+    'https://good.com/',
+    'ws://good.com/chat',
+    'wss://good.com/chat',
+    'ftp://good.com/',
+    '//good.com/path',
+    '/absolute/path',
+    'relative/path'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    const parsed = fastURI.parse(input)
+    t.notOk(parsed.error, input)
+  })
+})

package/test/urn-full-input.test.js

@@ -0,0 +1,29 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+test('URN parsing validates the complete scheme-specific input', (t) => {
+  const embedded = fastURI.parse('urn:x|foo:bar')
+  t.equal(embedded.error, 'URN can not be parsed.', 'does not search for a later nid:nss substring')
+  t.equal(embedded.nid, undefined, 'does not adopt the later nid')
+  t.equal(embedded.nss, undefined, 'does not adopt the later nss')
+
+  const trailing = fastURI.parse('urn:foo:bar|ignored')
+  t.equal(trailing.error, 'URN can not be parsed.', 'rejects trailing input outside the RFC 2141 NSS grammar')
+  t.equal(trailing.nid, undefined, 'does not return an nid from a partial match')
+  t.equal(trailing.nss, undefined, 'does not return a truncated nss')
+
+  t.end()
+})
+
+test('URN parsing preserves the complete RFC 2141 NSS', (t) => {
+  const parsed = fastURI.parse('urn:foo:allowed/evil')
+  t.equal(parsed.error, undefined, 'accepts slash in an RFC 2141 NSS')
+  t.equal(parsed.nid, 'foo', 'parses the nid')
+  t.equal(parsed.nss, 'allowed/evil', 'preserves the complete NSS')
+  t.equal(fastURI.normalize('urn:foo:allowed/evil'), 'urn:foo:allowed/evil', 'normalization retains slash data')
+  t.equal(fastURI.equal('urn:foo:allowed/evil', 'urn:foo:allowed'), false, 'distinct NSS values do not compare equal')
+
+  t.end()
+})

package/test/websocket-query-preservation.test.js

@@ -0,0 +1,24 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+test('WebSocket queries preserve additional question marks', (t) => {
+  for (const scheme of ['ws', 'wss']) {
+    const uri = `${scheme}://example.com/chat?a?b`
+    const truncatedURI = `${scheme}://example.com/chat?a`
+    const parsed = fastURI.parse(uri)
+
+    t.equal(parsed.resourceName, '/chat?a?b', `${scheme} parse preserves the resource name`)
+    t.equal(fastURI.serialize(parsed), uri, `${scheme} parsed components round-trip`)
+    t.equal(
+      fastURI.serialize({ scheme, host: 'example.com', resourceName: '/chat?a?b' }),
+      uri,
+      `${scheme} resource name serializes without truncation`
+    )
+    t.equal(fastURI.normalize(uri), uri, `${scheme} normalization preserves the full query`)
+    t.equal(fastURI.equal(uri, truncatedURI), false, `${scheme} equality distinguishes the full query`)
+  }
+
+  t.end()
+})