fast-uri 4.1.3 → 4.1.4

package/index.js

@@ -328,6 +328,18 @@ function hasMalformedPercentEncoding (component) {
   return false
 }
 
+/**
+ * Whether the host is a bracketed IP literal (RFC 3986 `IP-literal`).
+ * An unterminated `[` is not a literal, so it must still be validated as a
+ * reg-name instead of being waved through as an IP.
+ *
+ * @param {string} host
+ * @returns {boolean}
+ */
+function isIPLiteral (host) {
+  return host[0] === '[' && host[host.length - 1] === ']'
+}
+
 /**
  * @param {RegExpMatchArray} matches
  * @returns {boolean}
@@ -337,7 +349,7 @@ function hasMalformedComponentPercentEncoding (matches) {
   // compatibility. Their parsing is intentionally left to normalizeIPv6.
   const host = matches[4]
   return hasMalformedPercentEncoding(matches[3]) ||
-    (host !== undefined && !(host[0] === '[' && host[host.length - 1] === ']') && hasMalformedPercentEncoding(host)) ||
+    (host !== undefined && !isIPLiteral(host) && hasMalformedPercentEncoding(host)) ||
     hasMalformedPercentEncoding(matches[6]) ||
     hasMalformedPercentEncoding(matches[7]) ||
     hasMalformedPercentEncoding(matches[8])
@@ -351,13 +363,19 @@ function hasMalformedComponentPercentEncoding (matches) {
  * @returns {boolean} whether host conversion failed
  */
 function canonicalizeHost (parsed, options, schemeHandler, isIP) {
+  const bracketedIPLiteral =
+    parsed.host &&
+    parsed.host[0] === '[' &&
+    parsed.host[parsed.host.length - 1] === ']'
+
   if (
     !options.unicodeSupport &&
     (!schemeHandler || !schemeHandler.unicodeSupport) &&
     parsed.host &&
-    parsed.host[0] !== '[' &&
+    !isIPLiteral(parsed.host) &&
     (options.domainHost || (schemeHandler && schemeHandler.domainHost)) &&
     isIP === false &&
+    !bracketedIPLiteral &&
     nonSimpleDomain(parsed.host)
   ) {
     try {
@@ -367,6 +385,7 @@ function canonicalizeHost (parsed, options, schemeHandler, isIP) {
       return true
     }
   }
+
   return false
 }
 
@@ -480,10 +499,11 @@ function parseWithStatus (uri, opts) {
     if (parsed.host) {
       const ipv4result = isIPv4(parsed.host)
       if (ipv4result === false) {
-        const bracketedIPLiteral = parsed.host[0] === '[' && parsed.host[parsed.host.length - 1] === ']'
+        const bracketedIPLiteral = isIPLiteral(parsed.host)
+        const hasIPLiteralBracket = parsed.host.indexOf('[') !== -1 || parsed.host.indexOf(']') !== -1
         const ipv6result = normalizeIPv6(parsed.host)
         isIP = ipv6result.isIPV6 || ipv6result.isIPVFuture === true
-        malformedIPLiteral = bracketedIPLiteral && ipv6result.error === true
+        malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true)
         parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase()
 
         if (malformedIPLiteral) {
@@ -513,7 +533,9 @@ function parseWithStatus (uri, opts) {
     const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme)
 
     // convert Unicode IDN -> ASCII IDN when the effective scheme uses domain hosts
-    malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP)
+    if (!malformedIPLiteral) {
+      malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP)
+    }
 
     if (!schemeHandler || (schemeHandler && !schemeHandler.skipNormalize)) {
       if (uri.indexOf('%') !== -1) {

package/lib/utils.js

@@ -6,6 +6,9 @@ const isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\d
 /** @type {(value: string) => boolean} */
 const isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u)
 
+/** @type {(value: string) => boolean} */
+const isPort = RegExp.prototype.test.bind(/^\d*$/u)
+
 /** @type {(value: string) => boolean} */
 const isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu)
 
@@ -769,8 +772,12 @@ function recomposeAuthority (component) {
   }
 
   if (typeof component.port === 'number' || typeof component.port === 'string') {
+    const port = String(component.port)
+    if (!isPort(port)) {
+      throw new TypeError('URI port is malformed.')
+    }
     uriTokens.push(':')
-    uriTokens.push(String(component.port))
+    uriTokens.push(port)
   }
 
   return uriTokens.length ? uriTokens.join('') : undefined

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fast-uri",
   "description": "Dependency-free RFC 3986 URI toolbox",
-  "version": "4.1.3",
+  "version": "4.1.4",
   "main": "index.js",
   "type": "commonjs",
   "types": "types/index.d.ts",

package/test/component-safe-serialization.test.js

@@ -24,6 +24,64 @@ test('userinfo serialization cannot terminate the authority', (t) => {
   t.end()
 })
 
+test('port serialization rejects non-digit values', (t) => {
+  const malformedPorts = [
+    '@127.0.0.1:8124',
+    '8080@evil.example',
+    '8080/path',
+    '8080?query',
+    '8080#fragment',
+    '8080:9000',
+    '-1',
+    '1.5',
+    1.5,
+    NaN,
+    Infinity,
+    '\u0661'
+  ]
+
+  for (const port of malformedPorts) {
+    t.throws(
+      () => fastURI.serialize({ scheme: 'http', host: 'trusted.example', port, path: '/app' }),
+      /URI port is malformed\./,
+      String(port)
+    )
+  }
+
+  t.throws(
+    () => fastURI.normalize({ scheme: 'http', host: 'trusted.example', port: '@evil.example' }),
+    /URI port is malformed\./,
+    'object normalization rejects a malformed port'
+  )
+  t.equal(
+    fastURI.equal(
+      { scheme: 'http', host: 'trusted.example', port: '@evil.example' },
+      { scheme: 'http', host: 'trusted.example', port: '@evil.example' }
+    ),
+    false,
+    'object equality fails closed for a malformed port'
+  )
+  t.end()
+})
+
+test('port serialization preserves RFC 3986 digit values', (t) => {
+  const validPorts = [
+    [8080, '8080'],
+    ['8080', '8080'],
+    ['00080', '00080'],
+    ['', '']
+  ]
+
+  for (const [port, expected] of validPorts) {
+    t.equal(
+      fastURI.serialize({ scheme: 'uri', host: 'example.test', port }),
+      `uri://example.test:${expected}`,
+      JSON.stringify(port)
+    )
+  }
+  t.end()
+})
+
 test('query and fragment serialization cannot inject component delimiters', (t) => {
   const uri = fastURI.serialize({
     scheme: 'x',

package/test/ipv6-validation.test.js

@@ -88,3 +88,67 @@ test('valid IPv6, IPvFuture, embedded IPv4, and zone forms normalize safely', (t
   }
   t.end()
 })
+
+test('IPv6 zone identifiers are validated correctly', (t) => {
+  const valid = [
+    'http://[fe80::1%25eth0]/',
+    'http://[fe80::a%en1]/',
+    'http://[fe80::a%25eth%2D0]/'
+  ]
+
+  for (const uri of valid) {
+    const parsed = fastURI.parse(uri)
+
+    t.equal(parsed.error, undefined, `${uri} parses without error`)
+  }
+
+  const malformed = [
+    'http://[fe80::1%25]/',
+    'http://[fe80::1%25eth 0]/',
+    'http://[fe80::1%25eth%ZZ]/',
+    'http://[fe80::1%25K]/'
+  ]
+
+  for (const uri of malformed) {
+    const parsed = fastURI.parse(uri)
+
+    t.equal(parsed.error, HOST_ERROR, `${uri} is rejected`)
+    t.equal(fastURI.normalize(uri), uri, `${uri} is not rewritten`)
+    t.equal(fastURI.equal(uri, uri), false, `${uri} is not comparable`)
+  }
+  t.end()
+})
+
+test('hosts with unbalanced or misplaced IP-literal brackets are rejected', (t) => {
+  const malformed = [
+    'http://[fe80',
+    'http://[',
+    'http://[not-an-ip',
+    'http://[\u65e5\u672c',
+    'http://user@[@127.0.0.1:8123/admin',
+    'http://user@]127.0.0.1:8123/admin',
+    'http://user@prefix[@127.0.0.1:8123/admin',
+    'http://user@prefix]@127.0.0.1:8123/admin'
+  ]
+  const modes = [
+    ['default', undefined],
+    ['Unicode', { unicodeSupport: true }]
+  ]
+
+  for (const [mode, options] of modes) {
+    for (const uri of malformed) {
+      const parsed = fastURI.parse(uri, options)
+      const message = `${mode} mode rejects ${uri}`
+
+      t.equal(parsed.error, HOST_ERROR, `parse ${message}`)
+      t.equal(fastURI.normalize(uri, options), uri, `normalize preserves ${uri} in ${mode} mode`)
+      t.equal(fastURI.equal(uri, uri, options), false, `equal ${message}`)
+      t.throws(
+        () => fastURI.resolve('http://example.com/', uri, options),
+        /URI host is malformed\./,
+        `resolve ${message}`
+      )
+    }
+  }
+  t.end()
+})