fast-uri 4.2.0 → 4.2.1

package/lib/schemes.js

@@ -290,6 +290,7 @@ const DTEXT_IRI = allowSet(DTEXT_ALLOWED, true)
 const HEX_PAIR = /^[\da-f]{2}$/iu
 const MAILTO_DOMAIN_LITERAL = /^\[[\x21-\x5A\x5E-\x7E]*\]$/u
 const MAILTO_DOMAIN_ERROR = 'URI mailto has an invalid recipient domain.'
+const MAILTO_AUTHORITY_ERROR = 'URI mailto must not have an authority component.'
 const HAS_SURROGATE = /[\uD800-\uDFFF]/u
 
 /**
@@ -519,6 +520,27 @@ function mailtoParse (component, options) {
 
   mailtoComponent.query = undefined
 
+  // RFC 6068 defines no authority for the `mailto` scheme. A `mailto://` input
+  // that retains an authority and also carries recipients (from the path or a
+  // `to=` hfield) folds a leading "/" into the recipient local part on the
+  // next parse; the generic serializer then reinserts a "/" before that path
+  // on every pass, so serialize(parse(x)) is not a fixpoint and a
+  // renormalize-to-fixpoint loop accretes one "%2F" per pass. Drop the
+  // retained authority so the parse -> serialize round trip is stable. A bare
+  // `mailto://host` with no recipients is left as-is: it is idempotent and host
+  // normalization for skip-normalize schemes stays intact.
+  if (
+    to.length > 0 &&
+    (mailtoComponent.userinfo !== undefined ||
+      mailtoComponent.host !== undefined ||
+      mailtoComponent.port !== undefined)
+  ) {
+    mailtoComponent.userinfo = undefined
+    mailtoComponent.host = undefined
+    mailtoComponent.port = undefined
+    mailtoComponent.error = mailtoComponent.error || MAILTO_AUTHORITY_ERROR
+  }
+
   for (let i = 0; i < to.length; i++) {
     const rawAddr = to[i]
     const atIdx = rawAddr.lastIndexOf('@')
@@ -583,6 +605,14 @@ function mailtoSerialize (component, options) {
   mailtoComponent.headers = headers
 
   if (to.length) {
+    // RFC 6068 defines no authority for the `mailto` scheme. If an
+    // application constructs a component with both an authority and recipients,
+    // drop the authority before the generic serializer can insert a "/" path
+    // separator that becomes part of the first recipient on the next parse.
+    mailtoComponent.userinfo = undefined
+    mailtoComponent.host = undefined
+    mailtoComponent.port = undefined
+
     for (let i = 0; i < to.length; i++) {
       const addr = String(to[i])
       const atIdx = addr.lastIndexOf('@')

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fast-uri",
   "description": "Dependency-free RFC 3986 URI toolbox",
-  "version": "4.2.0",
+  "version": "4.2.1",
   "main": "index.js",
   "type": "commonjs",
   "types": "types/index.d.ts",

package/test/mailto-authority-security.test.js

@@ -0,0 +1,125 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+// GHSA-88VG-QFHM-JX5Q: `mailto://h/a` carries an authority (which RFC 6068 does
+// not define for `mailto`) and a path. `mailtoParse` used to retain that
+// authority and fold the path's leading "/" into the recipient local part; the
+// generic serializer then reinserted a "/" separator on every pass, so
+// serialize(parse(x)) was not a fixpoint and normalize() accreted one "%2F" per
+// pass (unbounded growth for a renormalize-to-fixpoint consumer).
+
+const authorityForms = [
+  ['mailto://h/a', 'mailto:%2Fa@'],
+  ['mailto://h/a@b', 'mailto:%2Fa@b'],
+  ['mailto://h/', 'mailto:%2F@'],
+  ['mailto://h/a,b', 'mailto:%2Fa@,b@'],
+  ['mailto://user@h/a', 'mailto:%2Fa@'],
+  ['mailto://h:8080/a', 'mailto:%2Fa@'],
+  ['mailto://', 'mailto://'],
+  // recipients can come from a `to=` hfield even when the path is empty
+  ['mailto://h?to=x@y', 'mailto:x@y'],
+  ['mailto://h?to=x@y&to=a@b', 'mailto:x@y,a@b']
+]
+
+test('mailto with a retained authority and a path normalizes to a fixpoint', (t) => {
+  t.plan(authorityForms.length * 2)
+
+  for (const [input] of authorityForms) {
+    const once = fastURI.normalize(input)
+    const twice = fastURI.normalize(once)
+
+    t.equal(twice, once, input + ' normalize is idempotent')
+    t.equal(fastURI.equal(input, once), true, input + ' equals its normalized form')
+  }
+})
+
+test('mailto serialize(parse()) is a stable round trip for the authority form', (t) => {
+  t.plan(authorityForms.length)
+
+  for (const [input, expected] of authorityForms) {
+    t.equal(fastURI.serialize(fastURI.parse(input)), expected, input + ' round trips to a stable value')
+  }
+})
+
+test('mailto authority form does not grow without bound under renormalization', (t) => {
+  // A renormalize-to-fixpoint loop must terminate instead of growing forever.
+  // A single normalize call already terminates, so this guards the fixpoint.
+  const inputs = ['mailto://h/a', 'mailto://h/a@b', 'mailto://h/a,b']
+
+  t.plan(inputs.length * 2)
+
+  for (const input of inputs) {
+    const first = fastURI.normalize(input)
+    let s = input
+    let iters = 0
+    let stable = false
+    while (iters < 1000) {
+      const next = fastURI.normalize(s)
+      if (next === s) {
+        stable = true
+        break
+      }
+      s = next
+      iters++
+    }
+
+    t.equal(stable, true, input + ' reaches a fixpoint')
+    t.equal(s.length, first.length, input + ' does not grow')
+  }
+})
+
+test('mailto authority handling preserves host normalization for skip-normalize schemes', (t) => {
+  // Regression: a bare `mailto://host` with no path must keep its host and stay
+  // idempotent, so the generic host normalization path is unaffected.
+  const encodedHost = 'mailto://%41.com'
+  const literalHost = 'mailto://a.com'
+
+  t.equal(fastURI.parse(encodedHost).host, fastURI.parse(literalHost).host, 'parse results have consistent hosts')
+  t.equal(fastURI.normalize(encodedHost), fastURI.normalize(literalHost), 'normalize results are consistent')
+  t.equal(fastURI.equal(encodedHost, literalHost), true, 'encoded and literal hosts compare equal')
+  t.equal(fastURI.normalize(literalHost), literalHost, 'bare authority mailto is idempotent')
+  t.end()
+})
+
+test('mailto authority form is reported as malformed on the parsed component', (t) => {
+  t.equal(
+    fastURI.parse('mailto://h/a').error,
+    'URI mailto must not have an authority component.',
+    'the retained authority is surfaced as an error'
+  )
+
+  // A valid, authority-free mailto must not be flagged.
+  t.equal(fastURI.parse('mailto:user@host.com').error, undefined, 'well-formed mailto has no error')
+  t.end()
+})
+
+test('mailto serializer drops caller-supplied authority when recipients are present', (t) => {
+  t.equal(
+    fastURI.serialize({ scheme: 'mailto', host: 'h', to: ['a@b'] }),
+    'mailto:a@b',
+    'authority is dropped for direct recipients'
+  )
+  t.equal(
+    fastURI.serialize({ scheme: 'mailto', userinfo: 'u', host: 'h', port: 8080, to: ['a@b'] }),
+    'mailto:a@b',
+    'userinfo, host, and port are dropped for direct recipients'
+  )
+  t.equal(
+    fastURI.serialize({ scheme: 'mailto', host: 'h', headers: { to: 'a@b' } }),
+    'mailto:a@b',
+    'authority is dropped for recipients supplied through a to hfield'
+  )
+  t.equal(
+    fastURI.serialize({ scheme: 'mailto', host: 'h', to: ['a@b'], subject: 'hello' }),
+    'mailto:a@b?subject=hello',
+    'dropping authority preserves header fields'
+  )
+  t.equal(
+    fastURI.serialize({ scheme: 'mailto', host: 'h' }),
+    'mailto://h',
+    'bare authority without recipients remains idempotent'
+  )
+  t.end()
+})