fast-uri 2.4.6 → 2.4.7

package/index.js

@@ -473,11 +473,17 @@ function parseWithStatus (uri, opts) {
       malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP)
     }
 
-    if (!schemeHandler || (schemeHandler && !schemeHandler.skipNormalize)) {
-      if (parsed.host !== undefined && !malformedIPLiteral) {
-        const host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true)
-        parsed.host = reescapeHostDelimiters(host, isIP)
+    if (uri.indexOf('%') !== -1 && parsed.host !== undefined && !malformedIPLiteral) {
+      let host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true)
+      if (!isIP) {
+        // Fold reg-name case after decoding unreserved octets. The second
+        // pass only restores uppercase hex in escapes that remain encoded.
+        host = normalizePercentEncoding(host.toLowerCase())
       }
+      parsed.host = reescapeHostDelimiters(host, isIP)
+    }
+
+    if (!schemeHandler || (schemeHandler && !schemeHandler.skipNormalize)) {
       if (parsed.path !== undefined && parsed.path.length) {
         parsed.path = normalizePathEncoding(parsed.path)
       }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fast-uri",
   "description": "Dependency free RFC 3986 URI toolbox",
-  "version": "2.4.6",
+  "version": "2.4.7",
   "main": "index.js",
   "type": "commonjs",
   "types": "types/index.d.ts",

package/test/security-normalization.test.js

@@ -126,6 +126,44 @@ test('hostname normalization decodes only current unreserved escapes', (t) => {
   t.end()
 })
 
+test('scheme-relative hostname normalization folds decoded ASCII case', (t) => {
+  const encodedHost = '//%41.com'
+  const normalizedHost = fastURI.normalize(encodedHost)
+  const encodedMetadata = '//%4Detadata.internal/private'
+  const literalMetadata = '//metadata.internal/private'
+
+  t.equal(fastURI.parse(encodedHost).host, 'a.com', 'parse folds an encoded uppercase host letter')
+  t.equal(normalizedHost, '//a.com', 'normalize emits a lowercase host')
+  t.equal(fastURI.normalize(normalizedHost), normalizedHost, 'host normalization is idempotent')
+  t.equal(fastURI.equal(encodedHost, '//a.com'), true, 'encoded and literal host spellings compare equal')
+  t.equal(fastURI.equal(encodedMetadata, literalMetadata), true, 'encoded metadata host compares equal')
+  t.equal(
+    fastURI.resolve('x://trusted.example/', encodedMetadata),
+    fastURI.resolve('x://trusted.example/', literalMetadata),
+    'encoded and literal metadata hosts resolve identically'
+  )
+  t.equal(
+    fastURI.normalize('//example.com%2fpath'),
+    '//example.com%2Fpath',
+    'reserved host escapes remain encoded with uppercase hex'
+  )
+  t.equal(fastURI.normalize('//%2541.com'), '//%2541.com', 'nested host escapes are not decoded twice')
+  t.equal(fastURI.equal('//User@%41.com/path', '//user@a.com/path'), false, 'userinfo remains case-sensitive')
+  t.equal(fastURI.equal('//%41.com/Path', '//a.com/path'), false, 'path remains case-sensitive')
+  t.equal(fastURI.equal('//%41.com/?Token=Value', '//a.com/?token=value'), false, 'query remains case-sensitive')
+  t.end()
+})
+
+test('host normalization applies to schemes that skip path normalization', (t) => {
+  const encodedHost = 'mailto://%41.com'
+  const literalHost = 'mailto://a.com'
+
+  t.equal(fastURI.parse(encodedHost).host, fastURI.parse(literalHost).host, 'parse results have consistent hosts')
+  t.equal(fastURI.normalize(encodedHost), fastURI.normalize(literalHost), 'normalize results are consistent')
+  t.equal(fastURI.equal(encodedHost, literalHost), true, 'encoded and literal hosts compare equal')
+  t.end()
+})
+
 test('host conversion failures are not treated as comparable URLs', (t) => {
   const malformedHost = 'http://trusted.test%2540evil.test/'