fast-uri 4.1.1 → 4.1.2

package/.github/workflows/ci.yml

@@ -30,11 +30,11 @@ jobs:
       matrix:
         node-version: ['20', '22', '24', '26']
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
@@ -54,11 +54,11 @@ jobs:
       matrix:
         node-version: ['16', '18', '20', '22', '24', '26']
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
@@ -77,11 +77,11 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '10'
           cache: 'npm'
@@ -119,11 +119,11 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '24'
           cache: 'npm'
@@ -147,7 +147,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    uses: fastify/workflows/.github/workflows/plugins-ci.yml@v6
+    uses: fastify/workflows/.github/workflows/plugins-ci.yml@2073dc8e1f9e172bf42daa3843c9dbd31af1e8cb # v6.0.0
     with:
       license-check: true
       lint: true

package/.github/workflows/lock-threads.yml

@@ -16,4 +16,4 @@ jobs:
     permissions:
       issues: write
       pull-requests: write
-    uses: fastify/workflows/.github/workflows/lock-threads.yml@v6
+    uses: fastify/workflows/.github/workflows/lock-threads.yml@2073dc8e1f9e172bf42daa3843c9dbd31af1e8cb # v6.0.0

package/.github/workflows/ossf-scorecard.yml

@@ -0,0 +1,45 @@
+name: OSSF Scorecard Analysis
+
+# **What it does**: Runs OSSF Scorecard analysis on the repository and uploads the results.
+# **Why we have it**: Security scanning.
+
+on:
+    branch_protection_rule:
+    push:
+        branches:
+            - main
+        paths-ignore:
+            - "docs/**"
+            - "*.md"
+    schedule:
+        #        ┌───────────── minute (0 - 59)
+        #        │  ┌───────────── hour (0 - 23)
+        #        │  │ ┌───────────── day of the month (1 - 31)
+        #        │  │ │ ┌───────────── month (1 - 12 or JAN-DEC)
+        #        │  │ │ │ ┌───────────── day of the week (0 - 6 or SUN-SAT)
+        #        │  │ │ │ │
+        #        │  │ │ │ │
+        #        │  │ │ │ │
+        #        *  * * * *
+        - cron: "21 17 * * 0"
+    # Allows this workflow to be run manually from the Actions tab
+    workflow_dispatch:
+
+# This allows a subsequently queued workflow run to interrupt previous runs
+concurrency:
+    group: "${{ github.workflow }}-${{ github.event.pull_request.head.label || github.head_ref || github.ref }}"
+    cancel-in-progress: true
+
+permissions:
+    contents: read
+
+jobs:
+    analysis:
+        name: OSSF Scorecard Analysis
+        permissions:
+            contents: read
+            id-token: write
+            security-events: write
+        uses: fastify/workflows/.github/workflows/reusable-ossf-scorecard.yml@ef591e2186785d5ab36b9fe6a79c7ce2f1d94e57 #v7.0.0
+        with:
+            publish_results: true

package/README.md

@@ -3,6 +3,7 @@
 [![NPM version](https://img.shields.io/npm/v/fast-uri.svg?style=flat)](https://www.npmjs.com/package/fast-uri)
 [![CI](https://github.com/fastify/fast-uri/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/fastify/fast-uri/actions/workflows/ci.yml)
 [![neostandard javascript style](https://img.shields.io/badge/code_style-neostandard-brightgreen?style=flat)](https://github.com/neostandard/neostandard)
+[![OSSF Scorecard](https://api.scorecard.dev/projects/github.com/fastify/fast-uri/badge)](https://scorecard.dev/viewer/?uri=github.com/fastify/fast-uri)
 
 Dependency-free RFC 3986 URI toolbox.
 

package/SECURITY.md

@@ -0,0 +1,168 @@
+# Security Policy
+
+This document describes the management of vulnerabilities for `fast-uri`, an
+official Fastify project package. It supplements the Fastify project's
+[organization-wide security policy](https://github.com/fastify/.github/blob/main/SECURITY.md).
+
+## Standards and scope
+
+`fast-uri` implements URI parsing and normalization according to
+[RFC 3986](https://www.rfc-editor.org/rfc/rfc3986). It does not implement the
+[WHATWG URL Standard](https://url.spec.whatwg.org/).
+
+Differences between `fast-uri` and WHATWG URL implementations are expected.
+Reports based on comparing or mixing parsers that follow these different
+standards are out of scope. Applications must use the same parsing and
+normalization rules for both security decisions and subsequent URI use.
+
+## Threat model
+
+`fast-uri`'s threat model extends the
+[Node.js threat model](https://github.com/nodejs/node/blob/main/SECURITY.md#the-nodejs-threat-model).
+
+**Trusted:** Application code, parser options, configuration, and the runtime
+environment.
+
+**Untrusted:** URI and IRI strings passed to the package's public APIs.
+
+### Examples of vulnerabilities
+
+- RFC 3986 parsing or normalization flaws that bypass security controls
+- Denial of service through malformed input
+- Inconsistent parsing or normalization between `fast-uri` APIs
+
+### Examples of non-vulnerabilities
+
+The following are **not** considered vulnerabilities in `fast-uri`:
+
+- **Different URL standards:** Differences between RFC 3986 behavior and
+  WHATWG URL behavior, including differences exposed by mixing parsers that
+  implement those standards
+- **Unsupported scheme semantics:** Scheme-specific behavior for schemes that
+  `fast-uri` does not document as supported
+- **Application code vulnerabilities:** Security flaws in code that consumes
+  `fast-uri` output
+- **Configuration mistakes:** Security issues caused by incorrect parser
+  options or application configuration
+- **Missing security features:** Application-level protections that are not
+  part of URI parsing or normalization
+- **Third-party dependencies:** Vulnerabilities in packages used by an
+  application alongside `fast-uri`
+
+## Reporting vulnerabilities
+
+Individuals who find potential vulnerabilities in `fast-uri` are invited to
+complete a vulnerability report via the
+[GitHub Security page][advisory].
+
+Do not assign or request a CVE directly.
+CVE assignment is handled by the Fastify Security Team.
+Fastify falls under the [OpenJS CNA](https://cna.openjsf.org/).
+A CVE will be assigned as part of our responsible disclosure process.
+
+> [!NOTE]
+> Fastify's [HackerOne](https://hackerone.com/fastify) program is now closed.
+
+[advisory]: ../../security/advisories/new
+
+### Strict measures when reporting vulnerabilities
+
+It is of the utmost importance that you read carefully and follow these
+guidelines to ensure the ecosystem as a whole is not disrupted due to
+improperly reported vulnerabilities:
+
+- Avoid creating new "informative" reports. Only create a new report if you are
+  confident the issue is an actual vulnerability. Third-party vendors and
+  individuals track new GitHub security reports and may flag them for their
+  customers.
+- Security reports should never be created and triaged by the same person. A
+  second Security Team member must triage a report submitted by a team member
+  or on their behalf. If in doubt, invite more Fastify collaborators to help
+  review the report.
+- **Do not** attempt to demonstrate CI/CD vulnerabilities by creating pull
+  requests in Fastify organization repositories. Doing so will result in a
+  [content report][content-report] to GitHub as an unsolicited exploit. Create
+  a separate repository configured like the affected repository and provide
+  the proof of concept there instead.
+
+[content-report]: https://docs.github.com/en/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam#reporting-an-issue-or-pull-request
+
+### Vulnerabilities found outside this process
+
+The Fastify project does not support vulnerability reporting outside the
+process described in this document.
+
+## Handling vulnerability reports
+
+When a potential vulnerability is reported, the following actions are taken.
+
+### Triage
+
+**Delay:** 4 business days
+
+Within 4 business days, a member of the Security Team provides a first response
+to the reporter. The possible responses are:
+
+- **Acceptance:** The report is considered a new vulnerability.
+- **Rejection:** The report is not considered a new vulnerability.
+- **Need more information:** The Security Team needs more information to
+  evaluate the report.
+
+Triaging should include updating these issue fields:
+
+- Asset: set or create the module affected by the report
+- Severity: TBD, initially left empty
+
+### Correction follow-up
+
+**Delay:** 90 days
+
+When a vulnerability is confirmed, a member of the Security Team volunteers to
+follow up on the report.
+
+With the reporter's help, they contact the maintainers of the vulnerable
+package and may invite them as participants in the report. Together, they
+define a publication date. Ideally, publication should not happen before the
+package has been patched.
+
+The report's vulnerable-version upper limit should be set to:
+
+- `*` if no fixed version is available when the report is published
+- the last vulnerable version, such as `<=1.2.3`, if the fix is released in
+  `1.2.4`
+
+### Publication
+
+**Delay:** 90 days
+
+Within 90 days after triage, the vulnerability must be made public.
+
+Vulnerability severity is assessed using
+[CVSS v3](https://www.first.org/cvss/user-guide).
+
+If package maintainers are actively developing a patch, the Security Team and
+the reporter may approve an additional delay.
+
+### Secondary contact
+
+If you do not receive an acknowledgment within 6 business days, or cannot find
+a private security contact, contact the OpenJS Foundation CNA at
+<https://cna.openjsf.org/> or `security@lists.openjsf.org` for assistance.
+
+The CNA can help ensure that reports are acknowledged, coordinate disclosure
+timelines, and assign CVEs when necessary.
+
+## The Fastify Security Team
+
+The core team manages the security program, policy, and process.
+
+Team members must keep all privileged information private. This includes the
+existence of undisclosed issues, expected release dates, and upcoming patches.
+
+### Members
+
+- [Matteo Collina](https://github.com/mcollina)
+- [Tomas Della Vedova](https://github.com/delvedor)
+- [Vincent Le Goff](https://github.com/zekth)
+- [KaKa Ng](https://github.com/climba03003)
+- [James Sumners](https://github.com/jsumners)

package/index.js

@@ -26,7 +26,12 @@ function normalize (uri, options) {
  */
 function resolve (baseURI, relativeURI, options) {
   const schemelessOptions = options ? Object.assign({ scheme: 'null' }, options) : { scheme: 'null' }
-  const resolved = resolveComponent(parse(baseURI, schemelessOptions), parse(relativeURI, schemelessOptions), schemelessOptions, true)
+  const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions)
+  const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions)
+  if (baseMalformed || relativeMalformed) {
+    throw new Error(baseParsed.error || relativeParsed.error || 'URI is malformed.')
+  }
+  const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true)
   schemelessOptions.skipEscape = true
   return serialize(resolved, schemelessOptions)
 }
@@ -206,6 +211,15 @@ const URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:
 // with or without a scheme prefix, for the literal-backslash rejection below.
 const AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/
 
+// Captures the leading authority-introducer region after an optional scheme: a
+// run of forward slashes, backslashes, and the characters the WHATWG URL parser
+// removes before parsing (TAB U+0009, LF U+000A, CR U+000D). A valid introducer
+// is exactly "//". Node treats "\" as "/" on special schemes and strips those
+// characters first, so forms like "\\", "/\", "\/", "/<TAB>/", or a leading
+// "<TAB>//" reach an authority in Node while fast-uri's URI_PARSE folds them into
+// the path group (host confusion / SSRF / redirect bypass).
+const AUTHORITY_INTRODUCER_REGION = /^(?:[^#/:?]+:)?([/\\\t\n\r]*)/
+
 /**
  * @param {import('./types/index').URIComponent} parsed
  * @param {RegExpMatchArray} matches
@@ -265,6 +279,28 @@ function parseWithStatus (uri, opts) {
     malformedAuthorityOrPort = true
   }
 
+  // Reject a malformed or whitespace-smuggled authority introducer. fast-uri
+  // only recognizes a literal "//"; anything else in the leading separator run
+  // (a backslash, or a "//" that appears only after removing the TAB/LF/CR that
+  // Node strips) means the authority fast-uri parses differs from the one Node's
+  // URL resolves. Reject rather than rewrite, mirroring the literal-backslash
+  // guard above. Percent-encoded forms (%5C, %09) are untouched, valid data.
+  const introducerMatch = uri.match(AUTHORITY_INTRODUCER_REGION)
+  if (introducerMatch !== null) {
+    const region = introducerMatch[1]
+    const normalizedRegion = region.replace(/[\t\n\r]/g, '')
+    // Two or more leading separators introduce an authority.
+    if (normalizedRegion.length >= 2) {
+      if (normalizedRegion.slice(0, 2) !== '//') {
+        parsed.error = parsed.error || 'URI authority must not contain a literal backslash.'
+        malformedAuthorityOrPort = true
+      } else if (region.length !== normalizedRegion.length) {
+        parsed.error = parsed.error || 'URI authority introducer must not contain whitespace.'
+        malformedAuthorityOrPort = true
+      }
+    }
+  }
+
   const matches = uri.match(URI_PARSE)
 
   if (matches) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fast-uri",
   "description": "Dependency-free RFC 3986 URI toolbox",
-  "version": "4.1.1",
+  "version": "4.1.2",
   "main": "index.js",
   "type": "commonjs",
   "types": "types/index.d.ts",

package/test/security.test.js

@@ -221,3 +221,139 @@ test('parse does not reject a literal backslash in the query or fragment', (t) =
   t.notOk(parsed.error, 'backslash in query/fragment does not mark the URI malformed')
   t.equal(parsed.host, 'host.example.com', 'host parsed normally')
 })
+
+test('parse rejects a malformed authority introducer (\\\\, /\\, \\/) in place of //', (t) => {
+  // Regression: "\\", "/\\", "\\/" after the scheme colon are not valid authority
+  // introducers. Node's URL treats "\\" as interchangeable with "/" on special
+  // schemes, so "http:\\\\evil.com/path" would be parsed as host "evil.com" by
+  // Node, but fast-uri must reject it as malformed to prevent SSRF/redirect bypass.
+  const cases = [
+    'http:\\\\evil.com/path',
+    'http:/\\evil.com/path',
+    'http:\\/evil.com/path',
+    'ws:\\\\evil.com/chat',
+    'wss:\\\\evil.com/chat',
+    'ftp:\\\\evil.com/',
+    '\\\\evil.com/path'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    t.equal(
+      fastURI.parse(input).error,
+      'URI authority must not contain a literal backslash.',
+      input
+    )
+  })
+})
+
+test('normalize does not canonicalize a malformed-authority-introducer URI', (t) => {
+  const cases = [
+    'http:\\\\evil.com/path',
+    'http:/\\evil.com/path'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    t.equal(fastURI.normalize(input), input, input)
+  })
+})
+
+test('equal returns false for malformed-authority-introducer URIs', (t) => {
+  const pairs = [
+    ['http:\\\\evil.com/path', 'http://evil.com/path'],
+    ['http:/\\evil.com/path', 'http://evil.com/path']
+  ]
+
+  t.plan(pairs.length)
+
+  pairs.forEach(([left, right]) => {
+    t.equal(fastURI.equal(left, right), false, `${left} != ${right}`)
+  })
+})
+
+test('resolve throws on malformed authority introducer', (t) => {
+  // resolve() returns a plain string with no error field, so the only safe
+  // behavior is to throw when either component has a malformed authority.
+  const pairs = [
+    ['https://allowed.com/', '\\\\evil.com/path'],
+    ['\\\\evil.com/path', 'https://allowed.com/'],
+    ['https://allowed.com/', 'http:/\\evil.com/path'],
+    ['https://allowed.com/', 'http:\\/evil.com/path']
+  ]
+
+  t.plan(pairs.length)
+
+  pairs.forEach(([base, rel]) => {
+    t.throws(
+      () => fastURI.resolve(base, rel),
+      /URI authority must not contain a literal backslash/,
+      `${base} + ${rel}`
+    )
+  })
+})
+
+test('parse rejects a whitespace-split authority introducer (TAB, LF, CR)', (t) => {
+  // The WHATWG URL parser removes TAB (U+0009), LF (U+000A) and CR (U+000D) from
+  // the input before parsing, so a stripped character wedged into the introducer
+  // ("/<TAB>\\", "/<TAB>/", or a leading "<TAB>//") reaches an authority in Node
+  // while fast-uri would otherwise fold it into the path. These must be rejected
+  // like the adjacent "\\", "/\\", "\\/" forms.
+  const cases = [
+    { input: '/\t\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: '/\t/evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' },
+    { input: '/\n\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: '/\r\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: '\t//evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' },
+    { input: '\t/\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: 'https:/\t/evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' }
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach(({ input, expectedError }) => {
+    t.equal(fastURI.parse(input).error, expectedError, JSON.stringify(input))
+  })
+})
+
+test('resolve throws on a whitespace-split authority introducer', (t) => {
+  const pairs = [
+    ['https://allowed.com/', '/\t\\evil.com/path'],
+    ['https://allowed.com/', '/\t/evil.com/path'],
+    ['https://allowed.com/', '/\n\\evil.com/path'],
+    ['/\t/evil.com/path', 'https://allowed.com/']
+  ]
+
+  t.plan(pairs.length)
+
+  pairs.forEach(([base, rel]) => {
+    t.throws(
+      () => fastURI.resolve(base, rel),
+      /URI authority (must not contain a literal backslash|introducer must not contain whitespace)/,
+      `${JSON.stringify(base)} + ${JSON.stringify(rel)}`
+    )
+  })
+})
+
+test('parse does not reject valid authority introducer patterns', (t) => {
+  // No false positives: "//" introducer and scheme-less "//" must be valid.
+  const cases = [
+    'http://good.com/',
+    'https://good.com/',
+    'ws://good.com/chat',
+    'wss://good.com/chat',
+    'ftp://good.com/',
+    '//good.com/path',
+    '/absolute/path',
+    'relative/path'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    const parsed = fastURI.parse(input)
+    t.notOk(parsed.error, input)
+  })
+})