fast-uri 4.1.3 → 4.1.5

package/index.js

@@ -328,6 +328,18 @@ function hasMalformedPercentEncoding (component) {
   return false
 }
 
+/**
+ * Whether the host is a bracketed IP literal (RFC 3986 `IP-literal`).
+ * An unterminated `[` is not a literal, so it must still be validated as a
+ * reg-name instead of being waved through as an IP.
+ *
+ * @param {string} host
+ * @returns {boolean}
+ */
+function isIPLiteral (host) {
+  return host[0] === '[' && host[host.length - 1] === ']'
+}
+
 /**
  * @param {RegExpMatchArray} matches
  * @returns {boolean}
@@ -337,7 +349,7 @@ function hasMalformedComponentPercentEncoding (matches) {
   // compatibility. Their parsing is intentionally left to normalizeIPv6.
   const host = matches[4]
   return hasMalformedPercentEncoding(matches[3]) ||
-    (host !== undefined && !(host[0] === '[' && host[host.length - 1] === ']') && hasMalformedPercentEncoding(host)) ||
+    (host !== undefined && !isIPLiteral(host) && hasMalformedPercentEncoding(host)) ||
     hasMalformedPercentEncoding(matches[6]) ||
     hasMalformedPercentEncoding(matches[7]) ||
     hasMalformedPercentEncoding(matches[8])
@@ -351,13 +363,19 @@ function hasMalformedComponentPercentEncoding (matches) {
  * @returns {boolean} whether host conversion failed
  */
 function canonicalizeHost (parsed, options, schemeHandler, isIP) {
+  const bracketedIPLiteral =
+    parsed.host &&
+    parsed.host[0] === '[' &&
+    parsed.host[parsed.host.length - 1] === ']'
+
   if (
     !options.unicodeSupport &&
     (!schemeHandler || !schemeHandler.unicodeSupport) &&
     parsed.host &&
-    parsed.host[0] !== '[' &&
+    !isIPLiteral(parsed.host) &&
     (options.domainHost || (schemeHandler && schemeHandler.domainHost)) &&
     isIP === false &&
+    !bracketedIPLiteral &&
     nonSimpleDomain(parsed.host)
   ) {
     try {
@@ -367,6 +385,7 @@ function canonicalizeHost (parsed, options, schemeHandler, isIP) {
       return true
     }
   }
+
   return false
 }
 
@@ -480,10 +499,11 @@ function parseWithStatus (uri, opts) {
     if (parsed.host) {
       const ipv4result = isIPv4(parsed.host)
       if (ipv4result === false) {
-        const bracketedIPLiteral = parsed.host[0] === '[' && parsed.host[parsed.host.length - 1] === ']'
+        const bracketedIPLiteral = isIPLiteral(parsed.host)
+        const hasIPLiteralBracket = parsed.host.indexOf('[') !== -1 || parsed.host.indexOf(']') !== -1
         const ipv6result = normalizeIPv6(parsed.host)
         isIP = ipv6result.isIPV6 || ipv6result.isIPVFuture === true
-        malformedIPLiteral = bracketedIPLiteral && ipv6result.error === true
+        malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true)
         parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase()
 
         if (malformedIPLiteral) {
@@ -513,15 +533,21 @@ function parseWithStatus (uri, opts) {
     const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme)
 
     // convert Unicode IDN -> ASCII IDN when the effective scheme uses domain hosts
-    malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP)
+    if (!malformedIPLiteral) {
+      malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP)
+    }
 
-    if (!schemeHandler || (schemeHandler && !schemeHandler.skipNormalize)) {
-      if (uri.indexOf('%') !== -1) {
-        if (parsed.host !== undefined && !malformedIPLiteral) {
-          const host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true)
-          parsed.host = reescapeHostDelimiters(host, isIP)
-        }
+    if (uri.indexOf('%') !== -1 && parsed.host !== undefined && !malformedIPLiteral) {
+      let host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true)
+      if (!isIP) {
+        // Fold reg-name case after decoding unreserved octets. The second
+        // pass only restores uppercase hex in escapes that remain encoded.
+        host = normalizePercentEncoding(host.toLowerCase())
       }
+      parsed.host = reescapeHostDelimiters(host, isIP)
+    }
+
+    if (!schemeHandler || (schemeHandler && !schemeHandler.skipNormalize)) {
       if (parsed.path) {
         parsed.path = normalizePathEncoding(parsed.path)
       }

package/lib/schemes.js

@@ -495,23 +495,24 @@ function mailtoParse (component, options) {
         mailtoComponent.error = mailtoComponent.error || 'URI mailto has malformed header fields.'
         continue
       }
-      const name = eqIdx === -1 ? token : token.slice(0, eqIdx)
+      const name = decodeHex(eqIdx === -1 ? token : token.slice(0, eqIdx))
+      const normalizedName = name.toLowerCase()
       const value = eqIdx === -1 ? '' : token.slice(eqIdx + 1)
-      if (name === 'to') {
+      if (normalizedName === 'to') {
         const addrs = value.split(',')
         for (let j = 0; j < addrs.length; j++) to.push(addrs[j])
         continue
       }
-      if (name === 'subject') {
+      if (normalizedName === 'subject') {
         mailtoComponent.subject = decodeHex(value)
         continue
       }
-      if (name === 'body') {
+      if (normalizedName === 'body') {
         mailtoComponent.body = decodeHex(value)
         continue
       }
       if (headers === null) headers = /** @type {Record<string,string>} */ (Object.create(null))
-      headers[decodeHex(name)] = decodeHex(value)
+      headers[name] = decodeHex(value)
     }
     if (headers !== null) mailtoComponent.headers = headers
   }
@@ -536,6 +537,18 @@ function mailtoParse (component, options) {
   return mailtoComponent
 }
 
+/**
+ * Encodes a decoded mailto header name. Unlike `encodeWithAllow`, a percent
+ * sign is always data here, even when followed by two hex digits. Preserving
+ * such a sequence as an existing escape would decode the name again on the
+ * next parse and could turn a generic header into `to`, `subject`, or `body`.
+ * @param {string} name
+ * @returns {string}
+ */
+function mailtoEncodeHeaderName (name) {
+  return encodeWithAllow(name.replace(/%/gu, '%25'), HFNAME)
+}
+
 /**
  * @param {import('../types/index').URIComponent} component
  * @param {import('../types/index').Options} options
@@ -544,6 +557,31 @@ function mailtoParse (component, options) {
 function mailtoSerialize (component, options) {
   const mailtoComponent = component
   const to = Array.isArray(mailtoComponent.to) ? mailtoComponent.to.slice() : []
+  const sourceHeaders = mailtoComponent.headers && typeof mailtoComponent.headers === 'object'
+    ? Object.assign(Object.create(null), mailtoComponent.headers)
+    : Object.create(null)
+  const headers = Object.create(null)
+
+  // Header field names are case-insensitive. Canonicalize the fields with
+  // dedicated component properties so callers cannot smuggle a second spelling
+  // through `headers`. As during parsing, all `to` fields are accumulated;
+  // repeated subject/body fields use the last value.
+  for (const name in sourceHeaders) {
+    const normalizedName = name.toLowerCase()
+    if (normalizedName === 'to') {
+      const addrs = String(sourceHeaders[name]).split(',')
+      for (let i = 0; i < addrs.length; i++) to.push(addrs[i])
+    } else if (normalizedName === 'subject' || normalizedName === 'body') {
+      headers[normalizedName] = sourceHeaders[name]
+    } else {
+      headers[name] = sourceHeaders[name]
+    }
+  }
+
+  if (mailtoComponent.subject !== undefined) headers.subject = mailtoComponent.subject
+  if (mailtoComponent.body !== undefined) headers.body = mailtoComponent.body
+  mailtoComponent.headers = headers
+
   if (to.length) {
     for (let i = 0; i < to.length; i++) {
       const addr = String(to[i])
@@ -570,21 +608,13 @@ function mailtoSerialize (component, options) {
     mailtoComponent.path = undefined
   }
 
-  const headers = mailtoComponent.headers && typeof mailtoComponent.headers === 'object'
-    ? Object.assign(Object.create(null), mailtoComponent.headers)
-    : Object.create(null)
-
-  if (mailtoComponent.subject) headers.subject = mailtoComponent.subject
-  if (mailtoComponent.body) headers.body = mailtoComponent.body
-  mailtoComponent.headers = headers
-
-  // `headers` has a null prototype and was filled via Object.assign, so every
-  // enumerable key is an own property and no hasOwnProperty guard is needed.
+  // `headers` has a null prototype, so every enumerable key is an own property
+  // and no hasOwnProperty guard is needed.
   let query = ''
   let count = 0
   for (const name in headers) {
     if (count++ !== 0) query += '&'
-    query += encodeWithAllow(name, HFNAME) + '=' + encodeWithAllow(String(headers[name]), HFNAME)
+    query += mailtoEncodeHeaderName(name) + '=' + encodeWithAllow(String(headers[name]), HFNAME)
   }
 
   if (count !== 0) {

package/lib/utils.js

@@ -6,6 +6,9 @@ const isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\d
 /** @type {(value: string) => boolean} */
 const isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u)
 
+/** @type {(value: string) => boolean} */
+const isPort = RegExp.prototype.test.bind(/^\d*$/u)
+
 /** @type {(value: string) => boolean} */
 const isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu)
 
@@ -769,8 +772,12 @@ function recomposeAuthority (component) {
   }
 
   if (typeof component.port === 'number' || typeof component.port === 'string') {
+    const port = String(component.port)
+    if (!isPort(port)) {
+      throw new TypeError('URI port is malformed.')
+    }
     uriTokens.push(':')
-    uriTokens.push(String(component.port))
+    uriTokens.push(port)
   }
 
   return uriTokens.length ? uriTokens.join('') : undefined

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fast-uri",
   "description": "Dependency-free RFC 3986 URI toolbox",
-  "version": "4.1.3",
+  "version": "4.1.5",
   "main": "index.js",
   "type": "commonjs",
   "types": "types/index.d.ts",

package/test/component-safe-serialization.test.js

@@ -24,6 +24,64 @@ test('userinfo serialization cannot terminate the authority', (t) => {
   t.end()
 })
 
+test('port serialization rejects non-digit values', (t) => {
+  const malformedPorts = [
+    '@127.0.0.1:8124',
+    '8080@evil.example',
+    '8080/path',
+    '8080?query',
+    '8080#fragment',
+    '8080:9000',
+    '-1',
+    '1.5',
+    1.5,
+    NaN,
+    Infinity,
+    '\u0661'
+  ]
+
+  for (const port of malformedPorts) {
+    t.throws(
+      () => fastURI.serialize({ scheme: 'http', host: 'trusted.example', port, path: '/app' }),
+      /URI port is malformed\./,
+      String(port)
+    )
+  }
+
+  t.throws(
+    () => fastURI.normalize({ scheme: 'http', host: 'trusted.example', port: '@evil.example' }),
+    /URI port is malformed\./,
+    'object normalization rejects a malformed port'
+  )
+  t.equal(
+    fastURI.equal(
+      { scheme: 'http', host: 'trusted.example', port: '@evil.example' },
+      { scheme: 'http', host: 'trusted.example', port: '@evil.example' }
+    ),
+    false,
+    'object equality fails closed for a malformed port'
+  )
+  t.end()
+})
+
+test('port serialization preserves RFC 3986 digit values', (t) => {
+  const validPorts = [
+    [8080, '8080'],
+    ['8080', '8080'],
+    ['00080', '00080'],
+    ['', '']
+  ]
+
+  for (const [port, expected] of validPorts) {
+    t.equal(
+      fastURI.serialize({ scheme: 'uri', host: 'example.test', port }),
+      `uri://example.test:${expected}`,
+      JSON.stringify(port)
+    )
+  }
+  t.end()
+})
+
 test('query and fragment serialization cannot inject component delimiters', (t) => {
   const uri = fastURI.serialize({
     scheme: 'x',

package/test/ipv6-validation.test.js

@@ -88,3 +88,67 @@ test('valid IPv6, IPvFuture, embedded IPv4, and zone forms normalize safely', (t
   }
   t.end()
 })
+
+test('IPv6 zone identifiers are validated correctly', (t) => {
+  const valid = [
+    'http://[fe80::1%25eth0]/',
+    'http://[fe80::a%en1]/',
+    'http://[fe80::a%25eth%2D0]/'
+  ]
+
+  for (const uri of valid) {
+    const parsed = fastURI.parse(uri)
+
+    t.equal(parsed.error, undefined, `${uri} parses without error`)
+  }
+
+  const malformed = [
+    'http://[fe80::1%25]/',
+    'http://[fe80::1%25eth 0]/',
+    'http://[fe80::1%25eth%ZZ]/',
+    'http://[fe80::1%25K]/'
+  ]
+
+  for (const uri of malformed) {
+    const parsed = fastURI.parse(uri)
+
+    t.equal(parsed.error, HOST_ERROR, `${uri} is rejected`)
+    t.equal(fastURI.normalize(uri), uri, `${uri} is not rewritten`)
+    t.equal(fastURI.equal(uri, uri), false, `${uri} is not comparable`)
+  }
+  t.end()
+})
+
+test('hosts with unbalanced or misplaced IP-literal brackets are rejected', (t) => {
+  const malformed = [
+    'http://[fe80',
+    'http://[',
+    'http://[not-an-ip',
+    'http://[\u65e5\u672c',
+    'http://user@[@127.0.0.1:8123/admin',
+    'http://user@]127.0.0.1:8123/admin',
+    'http://user@prefix[@127.0.0.1:8123/admin',
+    'http://user@prefix]@127.0.0.1:8123/admin'
+  ]
+  const modes = [
+    ['default', undefined],
+    ['Unicode', { unicodeSupport: true }]
+  ]
+
+  for (const [mode, options] of modes) {
+    for (const uri of malformed) {
+      const parsed = fastURI.parse(uri, options)
+      const message = `${mode} mode rejects ${uri}`
+
+      t.equal(parsed.error, HOST_ERROR, `parse ${message}`)
+      t.equal(fastURI.normalize(uri, options), uri, `normalize preserves ${uri} in ${mode} mode`)
+      t.equal(fastURI.equal(uri, uri, options), false, `equal ${message}`)
+      t.throws(
+        () => fastURI.resolve('http://example.com/', uri, options),
+        /URI host is malformed\./,
+        `resolve ${message}`
+      )
+    }
+  }
+  t.end()
+})

package/test/mailto-field-name-security.test.js

@@ -0,0 +1,151 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+function encodeCharacter (value, index, lowercaseHex) {
+  let hex = value.charCodeAt(index).toString(16)
+  if (!lowercaseHex) hex = hex.toUpperCase()
+  return value.slice(0, index) + '%' + hex + value.slice(index + 1)
+}
+
+function mailtoState (component) {
+  return {
+    to: component.to,
+    subject: component.subject,
+    body: component.body,
+    headers: component.headers && { ...component.headers }
+  }
+}
+
+test('mailto parsing classifies decoded, case-insensitive reserved field names', (t) => {
+  const cases = [
+    { name: 'to', value: 'attacker@evil.test', property: 'to' },
+    { name: 'subject', value: 'injected subject', property: 'subject' },
+    { name: 'body', value: 'injected body', property: 'body' }
+  ]
+
+  for (const entry of cases) {
+    const variants = new Set([entry.name.toUpperCase()])
+    for (let i = 0; i < entry.name.length; i++) {
+      variants.add(encodeCharacter(entry.name, i, false))
+      variants.add(encodeCharacter(entry.name, i, true))
+    }
+
+    for (const name of variants) {
+      const parsed = fastURI.parse(`mailto:alice@example.test?${name}=${entry.value}`)
+      if (entry.property === 'to') {
+        t.deepEqual(parsed.to, ['alice@example.test', entry.value], name + ' is classified as a recipient')
+      } else {
+        t.equal(parsed[entry.property], entry.value, name + ' is classified as ' + entry.property)
+      }
+      t.equal(parsed.headers, undefined, name + ' is not exposed as a generic header')
+
+      const reparsed = fastURI.parse(fastURI.serialize(parsed))
+      t.deepEqual(mailtoState(reparsed), mailtoState(parsed), name + ' keeps its meaning after a roundtrip')
+    }
+  }
+
+  t.end()
+})
+
+test('mailto generic field names are decoded exactly once across roundtrips', (t) => {
+  const cases = [
+    ['%2574o', '%74o'],
+    ['%2573ubject', '%73ubject'],
+    ['%2562ody', '%62ody'],
+    ['x%2520y', 'x%20y'],
+    ['%26to', '&to'],
+    ['%25GGto', '%GGto']
+  ]
+
+  for (const [encodedName, decodedName] of cases) {
+    let serialized = `mailto:alice@example.test?${encodedName}=value`
+    for (let round = 0; round < 3; round++) {
+      const parsed = fastURI.parse(serialized)
+      t.deepEqual({ ...parsed.headers }, { [decodedName]: 'value' }, encodedName + ' stays generic in round ' + round)
+      t.deepEqual(parsed.to, ['alice@example.test'], encodedName + ' does not add a recipient in round ' + round)
+      t.equal(parsed.subject, undefined, encodedName + ' does not set a subject in round ' + round)
+      t.equal(parsed.body, undefined, encodedName + ' does not set a body in round ' + round)
+      serialized = fastURI.serialize(parsed)
+    }
+    t.equal(serialized, `mailto:alice@example.test?${encodedName}=value`, encodedName + ' serializes idempotently')
+  }
+
+  t.equal(
+    fastURI.serialize({ scheme: 'mailto', to: ['alice@example.test'], headers: { '%74o': 'value' } }),
+    'mailto:alice@example.test?%2574o=value',
+    'a percent sequence in a decoded component key is encoded as data'
+  )
+  t.end()
+})
+
+test('mailto serialization canonicalizes reserved generic header names', (t) => {
+  const serialized = fastURI.serialize({
+    scheme: 'mailto',
+    to: ['alice@example.test'],
+    subject: 'safe subject',
+    body: 'safe body',
+    headers: {
+      TO: 'attacker@evil.test',
+      Subject: 'hidden subject',
+      BODY: 'hidden body',
+      cc: 'copy@example.test'
+    }
+  })
+
+  t.equal(
+    serialized,
+    'mailto:alice@example.test,attacker@evil.test?subject=safe%20subject&body=safe%20body&cc=copy@example.test',
+    'dedicated properties override header variants and all recipients are visible in the path'
+  )
+
+  const parsed = fastURI.parse(serialized)
+  t.deepEqual(parsed.to, ['alice@example.test', 'attacker@evil.test'], 'canonical recipients are classified consistently')
+  t.equal(parsed.subject, 'safe subject', 'the dedicated subject wins')
+  t.equal(parsed.body, 'safe body', 'the dedicated body wins')
+  t.deepEqual({ ...parsed.headers }, { cc: 'copy@example.test' }, 'only generic headers remain generic')
+
+  const empty = fastURI.serialize({
+    scheme: 'mailto',
+    to: ['alice@example.test'],
+    subject: '',
+    body: '',
+    headers: { Subject: 'hidden subject', BODY: 'hidden body' }
+  })
+  t.equal(empty, 'mailto:alice@example.test?subject=&body=', 'explicit empty properties override header variants')
+  const emptyParsed = fastURI.parse(empty)
+  t.equal(emptyParsed.subject, '', 'an empty subject round-trips')
+  t.equal(emptyParsed.body, '', 'an empty body round-trips')
+  t.end()
+})
+
+test('mailto duplicate reserved fields have deterministic parsing semantics', (t) => {
+  const parsed = fastURI.parse(
+    'mailto:alice@example.test?subject=first&%53UBJECT=last&body=first&%42ODY=last&to=one@example.test&%54O=two@example.test'
+  )
+
+  t.equal(parsed.subject, 'last', 'the last subject wins')
+  t.equal(parsed.body, 'last', 'the last body wins')
+  t.deepEqual(
+    parsed.to,
+    ['alice@example.test', 'one@example.test', 'two@example.test'],
+    'all recipient fields are accumulated'
+  )
+  t.equal(parsed.headers, undefined, 'no reserved spelling remains generic')
+  t.end()
+})
+
+test('encoded reserved field names expose decoded control characters immediately', (t) => {
+  const input = 'mailto:alice@example.test?%73ubject=hello%0D%0Aworld'
+  const parsed = fastURI.parse(input)
+
+  t.equal(parsed.subject, 'hello\r\nworld', 'the first parse exposes CRLF in the dedicated property')
+  t.equal(parsed.headers, undefined, 'the subject is not hidden as a generic header')
+  t.equal(
+    fastURI.parse(fastURI.serialize(parsed)).subject,
+    parsed.subject,
+    'the decoded subject remains stable after a roundtrip'
+  )
+  t.end()
+})

package/test/security-normalization.test.js

@@ -126,6 +126,44 @@ test('hostname normalization decodes only current unreserved escapes', (t) => {
   t.end()
 })
 
+test('scheme-relative hostname normalization folds decoded ASCII case', (t) => {
+  const encodedHost = '//%41.com'
+  const normalizedHost = fastURI.normalize(encodedHost)
+  const encodedMetadata = '//%4Detadata.internal/private'
+  const literalMetadata = '//metadata.internal/private'
+
+  t.equal(fastURI.parse(encodedHost).host, 'a.com', 'parse folds an encoded uppercase host letter')
+  t.equal(normalizedHost, '//a.com', 'normalize emits a lowercase host')
+  t.equal(fastURI.normalize(normalizedHost), normalizedHost, 'host normalization is idempotent')
+  t.equal(fastURI.equal(encodedHost, '//a.com'), true, 'encoded and literal host spellings compare equal')
+  t.equal(fastURI.equal(encodedMetadata, literalMetadata), true, 'encoded metadata host compares equal')
+  t.equal(
+    fastURI.resolve('x://trusted.example/', encodedMetadata),
+    fastURI.resolve('x://trusted.example/', literalMetadata),
+    'encoded and literal metadata hosts resolve identically'
+  )
+  t.equal(
+    fastURI.normalize('//example.com%2fpath'),
+    '//example.com%2Fpath',
+    'reserved host escapes remain encoded with uppercase hex'
+  )
+  t.equal(fastURI.normalize('//%2541.com'), '//%2541.com', 'nested host escapes are not decoded twice')
+  t.equal(fastURI.equal('//User@%41.com/path', '//user@a.com/path'), false, 'userinfo remains case-sensitive')
+  t.equal(fastURI.equal('//%41.com/Path', '//a.com/path'), false, 'path remains case-sensitive')
+  t.equal(fastURI.equal('//%41.com/?Token=Value', '//a.com/?token=value'), false, 'query remains case-sensitive')
+  t.end()
+})
+
+test('host normalization applies to schemes that skip path normalization', (t) => {
+  const encodedHost = 'mailto://%41.com'
+  const literalHost = 'mailto://a.com'
+
+  t.equal(fastURI.parse(encodedHost).host, fastURI.parse(literalHost).host, 'parse results have consistent hosts')
+  t.equal(fastURI.normalize(encodedHost), fastURI.normalize(literalHost), 'normalize results are consistent')
+  t.equal(fastURI.equal(encodedHost, literalHost), true, 'encoded and literal hosts compare equal')
+  t.end()
+})
+
 test('host conversion failures are not treated as comparable URLs', (t) => {
   const malformedHost = 'http://trusted.test%2540evil.test/'