fast-uri 4.1.4 → 4.1.5

package/index.js

@@ -537,13 +537,17 @@ function parseWithStatus (uri, opts) {
       malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP)
     }
 
-    if (!schemeHandler || (schemeHandler && !schemeHandler.skipNormalize)) {
-      if (uri.indexOf('%') !== -1) {
-        if (parsed.host !== undefined && !malformedIPLiteral) {
-          const host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true)
-          parsed.host = reescapeHostDelimiters(host, isIP)
-        }
+    if (uri.indexOf('%') !== -1 && parsed.host !== undefined && !malformedIPLiteral) {
+      let host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true)
+      if (!isIP) {
+        // Fold reg-name case after decoding unreserved octets. The second
+        // pass only restores uppercase hex in escapes that remain encoded.
+        host = normalizePercentEncoding(host.toLowerCase())
       }
+      parsed.host = reescapeHostDelimiters(host, isIP)
+    }
+
+    if (!schemeHandler || (schemeHandler && !schemeHandler.skipNormalize)) {
       if (parsed.path) {
         parsed.path = normalizePathEncoding(parsed.path)
       }

package/lib/schemes.js

@@ -495,23 +495,24 @@ function mailtoParse (component, options) {
         mailtoComponent.error = mailtoComponent.error || 'URI mailto has malformed header fields.'
         continue
       }
-      const name = eqIdx === -1 ? token : token.slice(0, eqIdx)
+      const name = decodeHex(eqIdx === -1 ? token : token.slice(0, eqIdx))
+      const normalizedName = name.toLowerCase()
       const value = eqIdx === -1 ? '' : token.slice(eqIdx + 1)
-      if (name === 'to') {
+      if (normalizedName === 'to') {
         const addrs = value.split(',')
         for (let j = 0; j < addrs.length; j++) to.push(addrs[j])
         continue
       }
-      if (name === 'subject') {
+      if (normalizedName === 'subject') {
         mailtoComponent.subject = decodeHex(value)
         continue
       }
-      if (name === 'body') {
+      if (normalizedName === 'body') {
         mailtoComponent.body = decodeHex(value)
         continue
       }
       if (headers === null) headers = /** @type {Record<string,string>} */ (Object.create(null))
-      headers[decodeHex(name)] = decodeHex(value)
+      headers[name] = decodeHex(value)
     }
     if (headers !== null) mailtoComponent.headers = headers
   }
@@ -536,6 +537,18 @@ function mailtoParse (component, options) {
   return mailtoComponent
 }
 
+/**
+ * Encodes a decoded mailto header name. Unlike `encodeWithAllow`, a percent
+ * sign is always data here, even when followed by two hex digits. Preserving
+ * such a sequence as an existing escape would decode the name again on the
+ * next parse and could turn a generic header into `to`, `subject`, or `body`.
+ * @param {string} name
+ * @returns {string}
+ */
+function mailtoEncodeHeaderName (name) {
+  return encodeWithAllow(name.replace(/%/gu, '%25'), HFNAME)
+}
+
 /**
  * @param {import('../types/index').URIComponent} component
  * @param {import('../types/index').Options} options
@@ -544,6 +557,31 @@ function mailtoParse (component, options) {
 function mailtoSerialize (component, options) {
   const mailtoComponent = component
   const to = Array.isArray(mailtoComponent.to) ? mailtoComponent.to.slice() : []
+  const sourceHeaders = mailtoComponent.headers && typeof mailtoComponent.headers === 'object'
+    ? Object.assign(Object.create(null), mailtoComponent.headers)
+    : Object.create(null)
+  const headers = Object.create(null)
+
+  // Header field names are case-insensitive. Canonicalize the fields with
+  // dedicated component properties so callers cannot smuggle a second spelling
+  // through `headers`. As during parsing, all `to` fields are accumulated;
+  // repeated subject/body fields use the last value.
+  for (const name in sourceHeaders) {
+    const normalizedName = name.toLowerCase()
+    if (normalizedName === 'to') {
+      const addrs = String(sourceHeaders[name]).split(',')
+      for (let i = 0; i < addrs.length; i++) to.push(addrs[i])
+    } else if (normalizedName === 'subject' || normalizedName === 'body') {
+      headers[normalizedName] = sourceHeaders[name]
+    } else {
+      headers[name] = sourceHeaders[name]
+    }
+  }
+
+  if (mailtoComponent.subject !== undefined) headers.subject = mailtoComponent.subject
+  if (mailtoComponent.body !== undefined) headers.body = mailtoComponent.body
+  mailtoComponent.headers = headers
+
   if (to.length) {
     for (let i = 0; i < to.length; i++) {
       const addr = String(to[i])
@@ -570,21 +608,13 @@ function mailtoSerialize (component, options) {
     mailtoComponent.path = undefined
   }
 
-  const headers = mailtoComponent.headers && typeof mailtoComponent.headers === 'object'
-    ? Object.assign(Object.create(null), mailtoComponent.headers)
-    : Object.create(null)
-
-  if (mailtoComponent.subject) headers.subject = mailtoComponent.subject
-  if (mailtoComponent.body) headers.body = mailtoComponent.body
-  mailtoComponent.headers = headers
-
-  // `headers` has a null prototype and was filled via Object.assign, so every
-  // enumerable key is an own property and no hasOwnProperty guard is needed.
+  // `headers` has a null prototype, so every enumerable key is an own property
+  // and no hasOwnProperty guard is needed.
   let query = ''
   let count = 0
   for (const name in headers) {
     if (count++ !== 0) query += '&'
-    query += encodeWithAllow(name, HFNAME) + '=' + encodeWithAllow(String(headers[name]), HFNAME)
+    query += mailtoEncodeHeaderName(name) + '=' + encodeWithAllow(String(headers[name]), HFNAME)
   }
 
   if (count !== 0) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fast-uri",
   "description": "Dependency-free RFC 3986 URI toolbox",
-  "version": "4.1.4",
+  "version": "4.1.5",
   "main": "index.js",
   "type": "commonjs",
   "types": "types/index.d.ts",

package/test/mailto-field-name-security.test.js

@@ -0,0 +1,151 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+function encodeCharacter (value, index, lowercaseHex) {
+  let hex = value.charCodeAt(index).toString(16)
+  if (!lowercaseHex) hex = hex.toUpperCase()
+  return value.slice(0, index) + '%' + hex + value.slice(index + 1)
+}
+
+function mailtoState (component) {
+  return {
+    to: component.to,
+    subject: component.subject,
+    body: component.body,
+    headers: component.headers && { ...component.headers }
+  }
+}
+
+test('mailto parsing classifies decoded, case-insensitive reserved field names', (t) => {
+  const cases = [
+    { name: 'to', value: 'attacker@evil.test', property: 'to' },
+    { name: 'subject', value: 'injected subject', property: 'subject' },
+    { name: 'body', value: 'injected body', property: 'body' }
+  ]
+
+  for (const entry of cases) {
+    const variants = new Set([entry.name.toUpperCase()])
+    for (let i = 0; i < entry.name.length; i++) {
+      variants.add(encodeCharacter(entry.name, i, false))
+      variants.add(encodeCharacter(entry.name, i, true))
+    }
+
+    for (const name of variants) {
+      const parsed = fastURI.parse(`mailto:alice@example.test?${name}=${entry.value}`)
+      if (entry.property === 'to') {
+        t.deepEqual(parsed.to, ['alice@example.test', entry.value], name + ' is classified as a recipient')
+      } else {
+        t.equal(parsed[entry.property], entry.value, name + ' is classified as ' + entry.property)
+      }
+      t.equal(parsed.headers, undefined, name + ' is not exposed as a generic header')
+
+      const reparsed = fastURI.parse(fastURI.serialize(parsed))
+      t.deepEqual(mailtoState(reparsed), mailtoState(parsed), name + ' keeps its meaning after a roundtrip')
+    }
+  }
+
+  t.end()
+})
+
+test('mailto generic field names are decoded exactly once across roundtrips', (t) => {
+  const cases = [
+    ['%2574o', '%74o'],
+    ['%2573ubject', '%73ubject'],
+    ['%2562ody', '%62ody'],
+    ['x%2520y', 'x%20y'],
+    ['%26to', '&to'],
+    ['%25GGto', '%GGto']
+  ]
+
+  for (const [encodedName, decodedName] of cases) {
+    let serialized = `mailto:alice@example.test?${encodedName}=value`
+    for (let round = 0; round < 3; round++) {
+      const parsed = fastURI.parse(serialized)
+      t.deepEqual({ ...parsed.headers }, { [decodedName]: 'value' }, encodedName + ' stays generic in round ' + round)
+      t.deepEqual(parsed.to, ['alice@example.test'], encodedName + ' does not add a recipient in round ' + round)
+      t.equal(parsed.subject, undefined, encodedName + ' does not set a subject in round ' + round)
+      t.equal(parsed.body, undefined, encodedName + ' does not set a body in round ' + round)
+      serialized = fastURI.serialize(parsed)
+    }
+    t.equal(serialized, `mailto:alice@example.test?${encodedName}=value`, encodedName + ' serializes idempotently')
+  }
+
+  t.equal(
+    fastURI.serialize({ scheme: 'mailto', to: ['alice@example.test'], headers: { '%74o': 'value' } }),
+    'mailto:alice@example.test?%2574o=value',
+    'a percent sequence in a decoded component key is encoded as data'
+  )
+  t.end()
+})
+
+test('mailto serialization canonicalizes reserved generic header names', (t) => {
+  const serialized = fastURI.serialize({
+    scheme: 'mailto',
+    to: ['alice@example.test'],
+    subject: 'safe subject',
+    body: 'safe body',
+    headers: {
+      TO: 'attacker@evil.test',
+      Subject: 'hidden subject',
+      BODY: 'hidden body',
+      cc: 'copy@example.test'
+    }
+  })
+
+  t.equal(
+    serialized,
+    'mailto:alice@example.test,attacker@evil.test?subject=safe%20subject&body=safe%20body&cc=copy@example.test',
+    'dedicated properties override header variants and all recipients are visible in the path'
+  )
+
+  const parsed = fastURI.parse(serialized)
+  t.deepEqual(parsed.to, ['alice@example.test', 'attacker@evil.test'], 'canonical recipients are classified consistently')
+  t.equal(parsed.subject, 'safe subject', 'the dedicated subject wins')
+  t.equal(parsed.body, 'safe body', 'the dedicated body wins')
+  t.deepEqual({ ...parsed.headers }, { cc: 'copy@example.test' }, 'only generic headers remain generic')
+
+  const empty = fastURI.serialize({
+    scheme: 'mailto',
+    to: ['alice@example.test'],
+    subject: '',
+    body: '',
+    headers: { Subject: 'hidden subject', BODY: 'hidden body' }
+  })
+  t.equal(empty, 'mailto:alice@example.test?subject=&body=', 'explicit empty properties override header variants')
+  const emptyParsed = fastURI.parse(empty)
+  t.equal(emptyParsed.subject, '', 'an empty subject round-trips')
+  t.equal(emptyParsed.body, '', 'an empty body round-trips')
+  t.end()
+})
+
+test('mailto duplicate reserved fields have deterministic parsing semantics', (t) => {
+  const parsed = fastURI.parse(
+    'mailto:alice@example.test?subject=first&%53UBJECT=last&body=first&%42ODY=last&to=one@example.test&%54O=two@example.test'
+  )
+
+  t.equal(parsed.subject, 'last', 'the last subject wins')
+  t.equal(parsed.body, 'last', 'the last body wins')
+  t.deepEqual(
+    parsed.to,
+    ['alice@example.test', 'one@example.test', 'two@example.test'],
+    'all recipient fields are accumulated'
+  )
+  t.equal(parsed.headers, undefined, 'no reserved spelling remains generic')
+  t.end()
+})
+
+test('encoded reserved field names expose decoded control characters immediately', (t) => {
+  const input = 'mailto:alice@example.test?%73ubject=hello%0D%0Aworld'
+  const parsed = fastURI.parse(input)
+
+  t.equal(parsed.subject, 'hello\r\nworld', 'the first parse exposes CRLF in the dedicated property')
+  t.equal(parsed.headers, undefined, 'the subject is not hidden as a generic header')
+  t.equal(
+    fastURI.parse(fastURI.serialize(parsed)).subject,
+    parsed.subject,
+    'the decoded subject remains stable after a roundtrip'
+  )
+  t.end()
+})

package/test/security-normalization.test.js

@@ -126,6 +126,44 @@ test('hostname normalization decodes only current unreserved escapes', (t) => {
   t.end()
 })
 
+test('scheme-relative hostname normalization folds decoded ASCII case', (t) => {
+  const encodedHost = '//%41.com'
+  const normalizedHost = fastURI.normalize(encodedHost)
+  const encodedMetadata = '//%4Detadata.internal/private'
+  const literalMetadata = '//metadata.internal/private'
+
+  t.equal(fastURI.parse(encodedHost).host, 'a.com', 'parse folds an encoded uppercase host letter')
+  t.equal(normalizedHost, '//a.com', 'normalize emits a lowercase host')
+  t.equal(fastURI.normalize(normalizedHost), normalizedHost, 'host normalization is idempotent')
+  t.equal(fastURI.equal(encodedHost, '//a.com'), true, 'encoded and literal host spellings compare equal')
+  t.equal(fastURI.equal(encodedMetadata, literalMetadata), true, 'encoded metadata host compares equal')
+  t.equal(
+    fastURI.resolve('x://trusted.example/', encodedMetadata),
+    fastURI.resolve('x://trusted.example/', literalMetadata),
+    'encoded and literal metadata hosts resolve identically'
+  )
+  t.equal(
+    fastURI.normalize('//example.com%2fpath'),
+    '//example.com%2Fpath',
+    'reserved host escapes remain encoded with uppercase hex'
+  )
+  t.equal(fastURI.normalize('//%2541.com'), '//%2541.com', 'nested host escapes are not decoded twice')
+  t.equal(fastURI.equal('//User@%41.com/path', '//user@a.com/path'), false, 'userinfo remains case-sensitive')
+  t.equal(fastURI.equal('//%41.com/Path', '//a.com/path'), false, 'path remains case-sensitive')
+  t.equal(fastURI.equal('//%41.com/?Token=Value', '//a.com/?token=value'), false, 'query remains case-sensitive')
+  t.end()
+})
+
+test('host normalization applies to schemes that skip path normalization', (t) => {
+  const encodedHost = 'mailto://%41.com'
+  const literalHost = 'mailto://a.com'
+
+  t.equal(fastURI.parse(encodedHost).host, fastURI.parse(literalHost).host, 'parse results have consistent hosts')
+  t.equal(fastURI.normalize(encodedHost), fastURI.normalize(literalHost), 'normalize results are consistent')
+  t.equal(fastURI.equal(encodedHost, literalHost), true, 'encoded and literal hosts compare equal')
+  t.end()
+})
+
 test('host conversion failures are not treated as comparable URLs', (t) => {
   const malformedHost = 'http://trusted.test%2540evil.test/'