fast-uri 4.1.1 → 4.1.3

package/lib/utils.js

@@ -13,10 +13,13 @@ const isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu)
 const isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu)
 
 /** @type {(value: string) => boolean} */
-const isPathCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/]$/iu)
+const isPathCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/]$/u)
 
 /** @type {(value: string) => boolean} */
-const isQueryFragmentCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/?]$/iu)
+const isQueryFragmentCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/?]$/u)
+
+/** @type {(value: string) => boolean} */
+const isUserinfoCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:]$/u)
 
 /**
  * @param {Array<string>} input
@@ -49,12 +52,14 @@ function stringArrayToHexStripped (input) {
   return acc
 }
 
-/**
- * @typedef {Object} GetIPV6Result
- * @property {boolean} error - Indicates if there was an error parsing the IPv6 address.
- * @property {string} address - The parsed IPv6 address.
- * @property {string} [zone] - The zone identifier, if present.
- */
+/** @type {(value: string) => boolean} */
+const isHextet = RegExp.prototype.test.bind(/^[\dA-Fa-f]{1,4}$/)
+
+/** @type {(value: string) => boolean} */
+const isIPvFuture = RegExp.prototype.test.bind(/^[vV][\dA-Fa-f]+\.[A-Za-z\d\-._~!$&'()*+,;=:]+$/)
+
+/** @type {(value: string) => boolean} */
+const isZoneCharacter = RegExp.prototype.test.bind(/^[A-Za-z\d\-._~]$/)
 
 /**
  * @param {string} value
@@ -62,89 +67,129 @@ function stringArrayToHexStripped (input) {
  */
 const nonSimpleDomain = RegExp.prototype.test.bind(/[^!"$&'()*+,\-.;=_`a-z{}~]/u)
 
+/** @type {(value: string) => boolean} */
+const nonSimpleDomainChars = RegExp.prototype.test.bind(/[^\d!"$&'()*+,\-.;=_`a-z{}~]/u)
+
+/** @type {(value: string) => boolean} */
+const numericLastLabel = RegExp.prototype.test.bind(/(?:^|\.)\d+$/u)
+
 /**
- * @param {Array<string>} buffer
+ * True when `new URL('http://' + domain).hostname` may differ from `domain`,
+ * i.e. when the caller must fall back to the WHATWG parser.
+ *
+ * Same purpose as `nonSimpleDomain`, but digits are allowed: for this character
+ * set `hostname` is the identity, *except* that an all-numeric final label is
+ * read as IPv4 shorthand ("1.2.3" -> "1.2.0.3", "127.1" -> "127.0.0.1",
+ * "a.b.1" throws), which is why `nonSimpleDomain` excludes digits outright.
+ * Rejecting that one shape lets the common `mail2.example.org` case stay on the
+ * fast path.
+ *
+ * @param {string} domain - must already be lowercased
  * @returns {boolean}
  */
-function consumeIsZone (buffer) {
-  buffer.length = 0
-  return true
+function nonSimpleMailtoDomain (domain) {
+  return nonSimpleDomainChars(domain) || numericLastLabel(domain)
 }
 
 /**
- * @param {Array<string>} buffer
- * @param {Array<string>} address
- * @param {GetIPV6Result} output
+ * @param {string} zone
  * @returns {boolean}
  */
-function consumeHextets (buffer, address, output) {
-  if (buffer.length) {
-    const hex = stringArrayToHexStripped(buffer)
-    if (hex !== '') {
-      address.push(hex)
-    } else {
-      output.error = true
-      return false
+function isZoneIdentifier (zone) {
+  if (zone.length === 0) return false
+
+  for (let i = 0; i < zone.length; i++) {
+    if (isZoneCharacter(zone[i])) continue
+    if (zone[i] === '%' && i + 2 < zone.length && isHexPair(zone.slice(i + 1, i + 3))) {
+      i += 2
+      continue
     }
-    buffer.length = 0
+    return false
   }
+
   return true
 }
 
 /**
- * @param {string} input
- * @returns {GetIPV6Result}
+ * Compresses the longest run of zero hextets to "::" per RFC 5952. A run of a
+ * single zero hextet is left uncompressed. On ties the leftmost run wins.
+ *
+ * @param {string[]} hextets
+ * @returns {string}
  */
-function getIPV6 (input) {
-  let tokenCount = 0
-  const output = { error: false, address: '', zone: '' }
-  /** @type {Array<string>} */
-  const address = []
-  /** @type {Array<string>} */
-  const buffer = []
-  let endipv6Encountered = false
-  let endIpv6 = false
-
-  let consume = consumeHextets
-
-  for (let i = 0; i < input.length; i++) {
-    const cursor = input[i]
-    if (cursor === '[' || cursor === ']') { continue }
-    if (cursor === ':') {
-      if (endipv6Encountered === true) {
-        endIpv6 = true
-      }
-      if (!consume(buffer, address, output)) { break }
-      if (++tokenCount > 7) {
-        // not valid
-        output.error = true
-        break
-      }
-      if (i > 0 && input[i - 1] === ':') {
-        endipv6Encountered = true
+function compressIPv6ZeroRun (hextets) {
+  let bestStart = -1
+  let bestLength = 0
+  let runStart = -1
+  let runLength = 0
+  for (let i = 0; i < hextets.length; i++) {
+    if (hextets[i] === '0') {
+      if (runStart === -1) runStart = i
+      runLength++
+      if (runLength > bestLength) {
+        bestLength = runLength
+        bestStart = runStart
       }
-      address.push(':')
-      continue
-    } else if (cursor === '%') {
-      if (!consume(buffer, address, output)) { break }
-      // switch to zone detection
-      consume = consumeIsZone
     } else {
-      buffer.push(cursor)
-      continue
+      runStart = -1
+      runLength = 0
     }
   }
-  if (buffer.length) {
-    if (consume === consumeIsZone) {
-      output.zone = buffer.join('')
-    } else if (endIpv6) {
-      address.push(buffer.join(''))
-    } else {
-      address.push(stringArrayToHexStripped(buffer))
+
+  if (bestLength < 2) return hextets.join(':')
+
+  const head = hextets.slice(0, bestStart).join(':')
+  const tail = hextets.slice(bestStart + bestLength).join(':')
+  return head + '::' + tail
+}
+
+/**
+ * Validates an IPv6 address against the alternatives in RFC 3986 section
+ * 3.2.2 and returns the same address with leading hextet zeroes removed.
+ * An embedded IPv4 address counts as two hextets and is only valid at the end.
+ *
+ * @param {string} input
+ * @returns {string|undefined}
+ */
+function normalizeIPv6Address (input) {
+  const compression = input.indexOf('::')
+  if (compression !== -1 && input.indexOf('::', compression + 1) !== -1) return undefined
+
+  const left = compression === -1 ? input.split(':') : input.slice(0, compression).split(':')
+  const right = compression === -1 ? [] : input.slice(compression + 2).split(':')
+  if (compression !== -1) {
+    if (left.length === 1 && left[0] === '') left.length = 0
+    if (right.length === 1 && right[0] === '') right.length = 0
+  }
+
+  const parts = left.concat(right)
+  let hextetCount = 0
+  for (let i = 0; i < parts.length; i++) {
+    const part = parts[i]
+    if (part === '') return undefined
+
+    if (part.indexOf('.') !== -1) {
+      if (i !== parts.length - 1 || (compression !== -1 && right.length === 0) || !isIPv4(part)) return undefined
+      hextetCount += 2
+      continue
     }
+
+    if (!isHextet(part)) return undefined
+    parts[i] = parseInt(part, 16).toString(16)
+    hextetCount++
   }
-  output.address = address.join('')
-  return output
+
+  if (compression === -1) {
+    if (hextetCount !== 8) return undefined
+    return compressIPv6ZeroRun(parts)
+  }
+  if (hextetCount >= 8) return undefined
+
+  // expand "::" then re-compress the longest run for a canonical result
+  const expanded = parts.slice(0, left.length)
+  for (let i = hextetCount; i < 8; i++) expanded.push('0')
+  for (let i = left.length; i < parts.length; i++) expanded.push(parts[i])
+  return compressIPv6ZeroRun(expanded)
 }
 
 /**
@@ -152,26 +197,49 @@ function getIPV6 (input) {
  * @property {string} host - The normalized host.
  * @property {string} [escapedHost] - The escaped host.
  * @property {boolean} isIPV6 - Indicates if the host is an IPv6 address.
+ * @property {boolean} [isIPVFuture] - Indicates if the host is an IPvFuture literal.
+ * @property {boolean} [error] - Indicates if a bracketed IP literal is malformed.
  */
 
 /**
+ * Validates and normalizes a bracketed IP literal. Raw zone separators remain
+ * accepted for backwards compatibility, while encoded separators and zone
+ * contents follow RFC 6874.
+ *
  * @param {string} host
  * @returns {NormalizeIPv6Result}
  */
 function normalizeIPv6 (host) {
-  if (findToken(host, ':') < 2) { return { host, isIPV6: false } }
-  const ipv6 = getIPV6(host)
-
-  if (!ipv6.error) {
-    let newHost = ipv6.address
-    let escapedHost = ipv6.address
-    if (ipv6.zone) {
-      newHost += '%' + ipv6.zone
-      escapedHost += '%25' + ipv6.zone
-    }
-    return { host: newHost, isIPV6: true, escapedHost }
-  } else {
-    return { host, isIPV6: false }
+  const bracketed = host[0] === '[' && host[host.length - 1] === ']'
+  const hasBracket = host[0] === '[' || host[host.length - 1] === ']'
+  if (hasBracket && !bracketed) return { host, isIPV6: false, error: true }
+
+  let input = bracketed ? host.slice(1, -1) : host
+  if (bracketed && isIPvFuture(input)) {
+    input = input.toLowerCase()
+    return { host: `[${input}]`, escapedHost: input, isIPV6: false, isIPVFuture: true }
+  }
+
+  if (findToken(input, ':') < 2) {
+    return { host, isIPV6: false, error: bracketed }
+  }
+
+  let zoneIdentifier = ''
+  const zoneSeparator = input.indexOf('%')
+  if (zoneSeparator !== -1) {
+    const separatorLength = input.slice(zoneSeparator, zoneSeparator + 3).toLowerCase() === '%25' ? 3 : 1
+    zoneIdentifier = input.slice(zoneSeparator + separatorLength)
+    if (!isZoneIdentifier(zoneIdentifier)) return { host, isIPV6: false, error: true }
+    input = input.slice(0, zoneSeparator)
+  }
+
+  const address = normalizeIPv6Address(input)
+  if (address === undefined) return { host, isIPV6: false, error: true }
+
+  return {
+    host: address + (zoneIdentifier ? '%' + zoneIdentifier : ''),
+    escapedHost: address + (zoneIdentifier ? '%25' + zoneIdentifier : ''),
+    isIPV6: true
   }
 }
 
@@ -297,7 +365,7 @@ function reescapeHostDelimiters (host, isIP) {
 
 /**
  * Normalizes percent escapes and optionally decodes only unreserved ASCII bytes.
- * Reserved delimiters such as `%2F` and `%2E` stay escaped.
+ * Reserved delimiters such as `%2F` stay escaped; `%2E` is unreserved.
  *
  * @param {string} input
  * @param {boolean} [decodeUnreserved=false]
@@ -438,6 +506,60 @@ function normalizePathEncoding (input) {
   return output
 }
 
+/**
+ * Serializes a path without rewriting reserved data. Raw RFC 3986 path
+ * characters remain literal, valid escapes are preserved and uppercased, and
+ * everything else is UTF-8 percent-encoded. In a path-noscheme, a colon in the
+ * first segment must be escaped so the result cannot be parsed as a scheme.
+ *
+ * @param {string} input
+ * @param {boolean} [pathNoScheme=false]
+ * @returns {string}
+ */
+function serializePathEncoding (input, pathNoScheme = false) {
+  let output = ''
+  let firstSegment = pathNoScheme && input[0] !== '/'
+
+  for (let i = 0; i < input.length; i++) {
+    const ch = input[i]
+    if (ch === '%' && i + 2 < input.length) {
+      const hex = input.slice(i + 1, i + 3)
+      if (isHexPair(hex)) {
+        output += '%' + hex.toUpperCase()
+        i += 2
+        continue
+      }
+    }
+
+    if (ch === '/') {
+      firstSegment = false
+    }
+
+    if (isPathCharacter(ch) && (ch !== ':' || !firstSegment)) {
+      output += ch
+    } else {
+      const code = input.charCodeAt(i)
+      if (code < 0x80) {
+        output += BYTE_HEX[code]
+      } else if (code < 0xD800 || code > 0xDFFF) {
+        output += percentEncodeNonAscii(code)
+      } else if (code <= 0xDBFF && i + 1 < input.length) {
+        const low = input.charCodeAt(i + 1)
+        if (low >= 0xDC00 && low <= 0xDFFF) {
+          output += percentEncodeNonAscii(0x10000 + ((code - 0xD800) << 10) + (low - 0xDC00))
+          i++
+        } else {
+          output += percentEncodeNonAscii(0xFFFD)
+        }
+      } else {
+        output += percentEncodeNonAscii(0xFFFD)
+      }
+    }
+  }
+
+  return output
+}
+
 /**
  * Normalizes the percent-encoding of a query or fragment component.
  *
@@ -495,6 +617,85 @@ function normalizeQueryFragmentEncoding (input) {
   return output
 }
 
+/**
+ * Percent-encodes a URI component using its RFC 3986 literal character set.
+ * Existing valid escapes are preserved and normalized to uppercase hex.
+ *
+ * @param {string} input
+ * @param {(value: string) => boolean} isAllowed
+ * @returns {string}
+ */
+function encodeComponent (input, isAllowed) {
+  let output = ''
+
+  for (let i = 0; i < input.length; i++) {
+    const ch = input[i]
+    if (ch === '%' && i + 2 < input.length) {
+      const hex = input.slice(i + 1, i + 3)
+      if (isHexPair(hex)) {
+        output += '%' + hex.toUpperCase()
+        i += 2
+        continue
+      }
+    }
+
+    if (isAllowed(ch)) {
+      output += ch
+    } else {
+      const code = input.charCodeAt(i)
+      if (code < 0x80) {
+        output += BYTE_HEX[code]
+      } else if (code < 0xD800 || code > 0xDFFF) {
+        output += percentEncodeNonAscii(code)
+      } else if (code <= 0xDBFF && i + 1 < input.length) {
+        const low = input.charCodeAt(i + 1)
+        if (low >= 0xDC00 && low <= 0xDFFF) {
+          output += percentEncodeNonAscii(0x10000 + ((code - 0xD800) << 10) + (low - 0xDC00))
+          i++
+        } else {
+          output += percentEncodeNonAscii(0xFFFD)
+        }
+      } else {
+        output += percentEncodeNonAscii(0xFFFD)
+      }
+    }
+  }
+
+  return output
+}
+
+/**
+ * Encodes userinfo while preserving its RFC 3986 §3.2.1 literal characters.
+ * In particular, authority delimiters such as `@`, `/`, `?`, and `#` are data.
+ *
+ * @param {string} input
+ * @returns {string}
+ */
+function encodeUserinfo (input) {
+  return encodeComponent(input, isUserinfoCharacter)
+}
+
+/**
+ * Encodes query data using the RFC 3986 §3.4 grammar. A literal `#` must be
+ * escaped because it would otherwise begin the fragment component.
+ *
+ * @param {string} input
+ * @returns {string}
+ */
+function encodeQuery (input) {
+  return encodeComponent(input, isQueryFragmentCharacter)
+}
+
+/**
+ * Encodes fragment data using the RFC 3986 §3.5 grammar.
+ *
+ * @param {string} input
+ * @returns {string}
+ */
+function encodeFragment (input) {
+  return encodeComponent(input, isQueryFragmentCharacter)
+}
+
 /**
  * Escapes a component while preserving existing valid percent escapes.
  *
@@ -544,15 +745,21 @@ function recomposeAuthority (component) {
   const uriTokens = []
 
   if (component.userinfo !== undefined) {
-    uriTokens.push(component.userinfo)
+    uriTokens.push(encodeUserinfo(component.userinfo))
     uriTokens.push('@')
   }
 
   if (component.host !== undefined) {
-    let host = unescape(component.host)
+    let host = component.host
     if (!isIPv4(host)) {
-      const ipV6res = normalizeIPv6(host)
-      if (ipV6res.isIPV6 === true) {
+      let ipV6res = normalizeIPv6(host)
+      if (ipV6res.isIPV6 !== true && ipV6res.isIPVFuture !== true) {
+        // Decode only unreserved bytes, once. In particular, keep %25 encoded
+        // so it cannot introduce a second escape during recomposition.
+        host = normalizePercentEncoding(host, true)
+        ipV6res = normalizeIPv6(host)
+      }
+      if (ipV6res.isIPV6 === true || ipV6res.isIPVFuture === true) {
         host = `[${ipV6res.escapedHost}]`
       } else {
         host = reescapeHostDelimiters(host, false)
@@ -570,12 +777,19 @@ function recomposeAuthority (component) {
 };
 
 module.exports = {
+  BYTE_HEX,
+  percentEncodeNonAscii,
   nonSimpleDomain,
+  nonSimpleMailtoDomain,
   recomposeAuthority,
   reescapeHostDelimiters,
   normalizePercentEncoding,
   normalizePathEncoding,
+  serializePathEncoding,
   normalizeQueryFragmentEncoding,
+  encodeUserinfo,
+  encodeQuery,
+  encodeFragment,
   escapePreservingEscapes,
   removeDotSegments,
   isIPv4,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fast-uri",
   "description": "Dependency-free RFC 3986 URI toolbox",
-  "version": "4.1.1",
+  "version": "4.1.3",
   "main": "index.js",
   "type": "commonjs",
   "types": "types/index.d.ts",

package/test/component-safe-serialization.test.js

@@ -0,0 +1,105 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+test('userinfo serialization cannot terminate the authority', (t) => {
+  const uri = fastURI.serialize({
+    scheme: 'http',
+    userinfo: 'attacker.example/',
+    host: 'trusted.example',
+    path: '/'
+  })
+
+  t.equal(uri, 'http://attacker.example%2F@trusted.example/', 'slash is encoded as userinfo data')
+
+  const reparsed = fastURI.parse(uri)
+  t.equal(reparsed.host, 'trusted.example', 'reparsing retains the supplied host')
+  t.equal(reparsed.userinfo, 'attacker.example%2F', 'encoded slash remains in userinfo')
+  t.equal(
+    fastURI.serialize({ userinfo: 'user@/?:#[]\\', host: 'example.test' }),
+    '//user%40%2F%3F:%23%5B%5D%5C@example.test',
+    'all userinfo component delimiters are encoded as data'
+  )
+  t.end()
+})
+
+test('query and fragment serialization cannot inject component delimiters', (t) => {
+  const uri = fastURI.serialize({
+    scheme: 'x',
+    path: '/resource',
+    query: 'key=value#still-query',
+    fragment: 'first#still-fragment'
+  })
+
+  t.equal(
+    uri,
+    'x:/resource?key=value%23still-query#first%23still-fragment',
+    'raw hashes are encoded within their supplied components'
+  )
+
+  const reparsed = fastURI.parse(uri)
+  t.equal(reparsed.query, 'key=value%23still-query', 'hash remains query data')
+  t.equal(reparsed.fragment, 'first%23still-fragment', 'hash remains fragment data')
+  t.end()
+})
+
+test('component serializers preserve each RFC 3986 literal character set', (t) => {
+  const unreservedAndSubDelims = "AZaz09-._~!$&'()*+,;="
+  const userinfo = unreservedAndSubDelims + ':'
+  const queryOrFragment = unreservedAndSubDelims + ':@/?'
+
+  t.equal(
+    fastURI.serialize({ userinfo, host: 'example.test' }),
+    '//' + userinfo + '@example.test',
+    'userinfo literals are preserved'
+  )
+  t.equal(
+    fastURI.serialize({ query: queryOrFragment }),
+    '?' + queryOrFragment,
+    'query literals are preserved'
+  )
+  t.equal(
+    fastURI.serialize({ fragment: queryOrFragment }),
+    '#' + queryOrFragment,
+    'fragment literals are preserved'
+  )
+  t.end()
+})
+
+test('component serializers preserve escapes and encode Unicode as UTF-8', (t) => {
+  t.equal(
+    fastURI.serialize({ userinfo: 'café/%2f%GG', host: 'example.test' }),
+    '//caf%C3%A9%2F%2F%25GG@example.test',
+    'userinfo preserves valid escapes, uppercases hex, and escapes malformed percent data'
+  )
+  t.equal(
+    fastURI.serialize({ query: '日本/%2f#%GG' }),
+    '?%E6%97%A5%E6%9C%AC/%2F%23%25GG',
+    'query uses UTF-8 and does not double encode valid escapes'
+  )
+  t.equal(
+    fastURI.serialize({ fragment: '😀/%3f#%GG' }),
+    '#%F0%9F%98%80/%3F%23%25GG',
+    'fragment uses UTF-8 and does not double encode valid escapes'
+  )
+  t.equal(
+    fastURI.serialize({ query: 'Kſ' }),
+    '?%E2%84%AA%C5%BF',
+    'Unicode characters that case-fold to ASCII are still UTF-8 encoded'
+  )
+  t.end()
+})
+
+test('parsed URI serialization remains stable', (t) => {
+  const input = 'x://user:pass@example.test/a%2Fb?x=a/b?c&y=%23#frag/a?b%23'
+  const serialized = fastURI.serialize(fastURI.parse(input))
+
+  t.equal(serialized, input, 'an already normalized parsed URI round-trips unchanged')
+  t.equal(
+    fastURI.serialize(fastURI.parse(serialized)),
+    serialized,
+    'repeated parse and serialize cycles are stable'
+  )
+  t.end()
+})

package/test/equal.test.js

@@ -21,6 +21,36 @@ test('URI Equals', (t) => {
   t.end()
 })
 
+test('URI Equals rejects malformed object input even when identical', (t) => {
+  const malformed = { scheme: 'http', host: 'example.com', port: 99999, path: '/x' }
+  t.equal(fn(malformed, malformed), false)
+  t.end()
+})
+
+test('URI Equals preserves case-sensitive components', (t) => {
+  const suite = [
+    { pair: ['http://example.com/Admin', 'http://example.com/admin'], result: false },
+    { pair: ['http://example.com/?token=SECRET', 'http://example.com/?token=secret'], result: false },
+    { pair: ['http://example.com/#Section', 'http://example.com/#section'], result: false },
+    { pair: ['http://User@example.com/', 'http://user@example.com/'], result: false },
+    { pair: ['urn:foo:CaseSensitive', 'urn:foo:casesensitive'], result: false },
+    { pair: ['ws://example.com/Chat', 'ws://example.com/chat'], result: false },
+    { pair: ['ws://example.com/?token=SECRET', 'ws://example.com/?token=secret'], result: false },
+    { pair: [{ scheme: 'http', host: 'example.com', path: '/Admin' }, { scheme: 'http', host: 'example.com', path: '/admin' }], result: false }
+  ]
+  runTest(t, suite)
+  t.end()
+})
+
+test('URI Equals folds normalized scheme and host case', (t) => {
+  const suite = [
+    { pair: ['HTTP://EXAMPLE.COM/resource', 'http://example.com/resource'], result: true },
+    { pair: [{ scheme: 'HTTP', host: 'EXAMPLE.COM', path: '/resource' }, { scheme: 'http', host: 'example.com', path: '/resource' }], result: true }
+  ]
+  runTest(t, suite)
+  t.end()
+})
+
 //   test('IRI Equals', (t) => {
 //     // example from RFC 3987
 //     t.equal(URI.equal('example://a/b/c/%7Bfoo%7D/ros\xE9', 'eXAMPLE://a/./b/../b/%63/%7bfoo%7d/ros%C3%A9', IRI_OPTION), true)
@@ -66,9 +96,7 @@ test('URN Equals', (t) => {
 
   runTest(t, suite)
 
-  t.throws(() => {
-    fn('urn:', 'urn:FOO:a123,456')
-  }, 'URN without nid cannot be serialized')
+  t.equal(fn('urn:', 'urn:FOO:a123,456'), false, 'malformed URN fails equality safely')
 
   t.end()
 })
@@ -107,6 +135,18 @@ test('WSS Equal', (t) => {
   t.end()
 })
 
+test('Mailto Equal normalizes domains without folding message data', (t) => {
+  const suite = [
+    { pair: ['mailto:user@EXAMPLE.ORG', 'mailto:user@example.org'], result: true },
+    { pair: ['mailto:User@example.org', 'mailto:user@example.org'], result: false },
+    { pair: ['mailto:user@example.org?subject=Hello', 'mailto:user@example.org?subject=hello'], result: false },
+    { pair: ['mailto:user@example.org?body=Hello', 'mailto:user@example.org?body=hello'], result: false },
+    { pair: ['mailto:user@example.org?x=Hello', 'mailto:user@example.org?x=hello'], result: false }
+  ]
+  runTest(t, suite)
+  t.end()
+})
+
 test('URI Equals tolerates malformed fragments', (t) => {
   t.equal(
     fastURI.equal('http://example.com/#%E0%A4A', 'http://example.com/#%E0%A4A'),