fast-uri 4.2.0 → 4.2.2

package/.github/workflows/release.yml

@@ -0,0 +1,24 @@
+name: Release the package
+
+on:
+  workflow_dispatch:
+    inputs:
+      semver:
+        description: 'Release bump type'
+        required: true
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
+
+permissions: {}
+
+jobs:
+  release:
+    permissions:
+      id-token: write # required for npm provenance via OIDC
+      contents: write # required to push the release commit and the tag
+    uses: fastify/workflows/.github/workflows/reusable-release.yml@b1a11bce713bc857e52b2231fec3c89071ad3135
+    with:
+      semver: ${{ inputs.semver }}

package/README.md

@@ -13,7 +13,7 @@ Dependency-free RFC 3986 URI toolbox.
 
 All of the above functions can accept an additional options argument that is an object that can contain one or more of the following properties:
 
-Malformed authorities and out-of-range ports are reported through the parsed component's `error` field. `normalize()` leaves malformed string inputs unchanged, and `equal()` returns `false` when either string input is malformed.
+Malformed authorities, out-of-range ports, and raw leading or trailing C0 controls or spaces (U+0000–U+0020) are reported through the parsed component's `error` field. `normalize()` leaves these malformed string inputs unchanged, and `equal()` returns `false`. `resolve()` rejects them in either input and rejects HTTP(S) results with an empty host. Percent-encoded and interior component data remain valid.
 
 *	`scheme` (string)
 	Indicates the scheme that the URI should be treated as, overriding the URI's normal scheme parsing behavior.

package/index.js

@@ -1,6 +1,6 @@
 'use strict'
 
-const { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require('./lib/utils')
+const { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, encodeHost, isIPv4, nonSimpleDomain } = require('./lib/utils')
 const { SCHEMES, getSchemeHandler } = require('./lib/schemes')
 
 const VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u
@@ -44,6 +44,7 @@ function resolve (baseURI, relativeURI, options) {
   const {
     parsed: baseParsed,
     malformedAuthorityOrPort: baseMalformed,
+    malformedReferenceEdge: baseMalformedReferenceEdge,
     malformedPercentEncoding: baseMalformedPercentEncoding,
     malformedSchemeSpecific: baseMalformedSchemeSpecific,
     malformedHost: baseMalformedHost,
@@ -52,6 +53,7 @@ function resolve (baseURI, relativeURI, options) {
   const {
     parsed: relativeParsed,
     malformedAuthorityOrPort: relativeMalformed,
+    malformedReferenceEdge: relativeMalformedReferenceEdge,
     malformedPercentEncoding: relativeMalformedPercentEncoding,
     malformedSchemeSpecific: relativeMalformedSchemeSpecific,
     malformedHost: relativeMalformedHost,
@@ -60,6 +62,8 @@ function resolve (baseURI, relativeURI, options) {
   if (
     baseMalformed ||
     relativeMalformed ||
+    baseMalformedReferenceEdge ||
+    relativeMalformedReferenceEdge ||
     baseMalformedPercentEncoding ||
     relativeMalformedPercentEncoding ||
     baseMalformedSchemeSpecific ||
@@ -74,6 +78,14 @@ function resolve (baseURI, relativeURI, options) {
   const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true)
   const resolvedSchemeHandler = getSchemeHandler((options && options.scheme) || resolved.scheme)
   const resolvedHost = resolved.host
+  // Inputs are parsed scheme-neutrally during resolution, so enforce the final
+  // HTTP scheme's required host before serializing an invalid HTTP URI.
+  if (
+    (resolved.scheme === 'http' || resolved.scheme === 'https') &&
+    !resolvedHost
+  ) {
+    throw new Error('HTTP URIs must have a host.')
+  }
   const resolvedHostIsIP = resolvedHost !== undefined && resolvedHost !== '' &&
     (isIPv4(resolvedHost) || normalizeIPv6(resolvedHost).isIPV6)
   canonicalizeHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP)
@@ -86,6 +98,9 @@ function resolve (baseURI, relativeURI, options) {
     throw new Error(resolved.error)
   }
   schemelessOptions.skipEscape = true
+  if (resolvedSchemeHandler && resolvedSchemeHandler.absolutePath) {
+    schemelessOptions.absolutePath = true
+  }
   return serialize(resolved, schemelessOptions)
 }
 
@@ -127,7 +142,10 @@ function resolveComponent (base, relative, options, skipNormalization) {
     target.userinfo = relative.userinfo
     copyHost(target, relative)
     target.port = relative.port
-    target.path = removeDotSegments(relative.path || '')
+    const relativeSchemeHandler = getSchemeHandler(relative.scheme)
+    target.path = relativeSchemeHandler && relativeSchemeHandler.absolutePath
+      ? relative.path || ''
+      : removeDotSegments(relative.path || '')
     target.query = relative.query
   } else {
     if (relative.userinfo !== undefined || relative.host !== undefined || relative.port !== undefined) {
@@ -243,7 +261,8 @@ function serialize (cmpts, opts) {
     uriTokens.push(component.scheme, ':')
   }
 
-  const authority = recomposeAuthority(component)
+  const allowNonAsciiHost = options.unicodeSupport === true || Boolean(schemeHandler && schemeHandler.unicodeSupport)
+  const authority = recomposeAuthority(component, allowNonAsciiHost)
   if (authority !== undefined) {
     if (options.reference !== 'suffix') {
       uriTokens.push('//')
@@ -409,7 +428,7 @@ function canonicalizeHost (parsed, options, schemeHandler, isIP) {
 /**
  * @param {string} uri
  * @param {import('./types/index').Options} [opts]
- * @returns {{ parsed: import('./types/index').URIComponent, malformedAuthorityOrPort: boolean, malformedPercentEncoding: boolean, malformedSchemeSpecific: boolean, malformedHost: boolean, malformedScheme: boolean }}
+ * @returns {{ parsed: import('./types/index').URIComponent, malformedAuthorityOrPort: boolean, malformedReferenceEdge: boolean, malformedPercentEncoding: boolean, malformedSchemeSpecific: boolean, malformedHost: boolean, malformedScheme: boolean }}
  */
 function parseWithStatus (uri, opts) {
   const options = Object.assign({}, opts)
@@ -425,6 +444,12 @@ function parseWithStatus (uri, opts) {
   }
 
   let malformedAuthorityOrPort = false
+  // Check the caller's original reference before suffix mode prepends a scheme
+  // or authority marker and turns its leading edge into interior data.
+  const malformedReferenceEdge = uri.length !== 0 && (
+    uri.charCodeAt(0) <= 0x20 ||
+    uri.charCodeAt(uri.length - 1) <= 0x20
+  )
   let malformedPercentEncoding = false
   let malformedSchemeSpecific = false
   let malformedHost = false
@@ -475,6 +500,10 @@ function parseWithStatus (uri, opts) {
     }
   }
 
+  if (malformedReferenceEdge) {
+    parsed.error = parsed.error || 'URI must not contain leading or trailing C0 controls or spaces.'
+  }
+
   const matches = uri.match(URI_PARSE)
 
   if (matches) {
@@ -564,14 +593,24 @@ function parseWithStatus (uri, opts) {
       malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP)
     }
 
-    if (uri.indexOf('%') !== -1 && parsed.host !== undefined && !malformedIPLiteral) {
-      let host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true)
-      if (!isIP) {
+    if (parsed.host !== undefined && !malformedIPLiteral) {
+      let host = parsed.host
+      if (uri.indexOf('%') !== -1 && !isIP) {
+        host = normalizePercentEncoding(host, true)
         // Fold reg-name case after decoding unreserved octets. The second
         // pass only restores uppercase hex in escapes that remain encoded.
         host = normalizePercentEncoding(host.toLowerCase())
       }
-      parsed.host = reescapeHostDelimiters(host, isIP)
+      // Resolution parses both inputs with the internal `null` scheme before
+      // the effective scheme is known. Preserve raw host characters for that
+      // intermediate step so the final scheme can apply domain canonicalization;
+      // the resolved authority is encoded when it is serialized.
+      if (options.scheme !== 'null') {
+        const allowNonAsciiHost = options.unicodeSupport === true || Boolean(schemeHandler && schemeHandler.unicodeSupport)
+        parsed.host = encodeHost(host, isIP, allowNonAsciiHost)
+      } else {
+        parsed.host = host
+      }
     }
 
     if (!schemeHandler || (schemeHandler && !schemeHandler.skipNormalize)) {
@@ -596,7 +635,7 @@ function parseWithStatus (uri, opts) {
   } else {
     parsed.error = parsed.error || 'URI can not be parsed.'
   }
-  return { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme }
+  return { parsed, malformedAuthorityOrPort, malformedReferenceEdge, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme }
 }
 
 /**
@@ -620,13 +659,14 @@ function normalizeString (uri, opts) {
 /**
  * @param {string} uri
  * @param {import('./types/index').Options} [opts]
- * @returns {{ normalized: string, malformedAuthorityOrPort: boolean, malformedPercentEncoding: boolean, malformedSchemeSpecific: boolean, malformedHost: boolean, malformedScheme: boolean }}
+ * @returns {{ normalized: string, malformedAuthorityOrPort: boolean, malformedReferenceEdge: boolean, malformedPercentEncoding: boolean, malformedSchemeSpecific: boolean, malformedHost: boolean, malformedScheme: boolean }}
  */
 function normalizeStringWithStatus (uri, opts) {
-  const { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = parseWithStatus(uri, opts)
+  const { parsed, malformedAuthorityOrPort, malformedReferenceEdge, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = parseWithStatus(uri, opts)
   return {
-    normalized: malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? uri : serialize(parsed, opts),
+    normalized: malformedAuthorityOrPort || malformedReferenceEdge || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? uri : serialize(parsed, opts),
     malformedAuthorityOrPort,
+    malformedReferenceEdge,
     malformedPercentEncoding,
     malformedSchemeSpecific,
     malformedHost,
@@ -650,8 +690,8 @@ function normalizeComparableURI (uri, opts) {
   } catch {
     return undefined
   }
-  const { normalized, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = normalizeStringWithStatus(value, opts)
-  return malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? undefined : normalized
+  const { normalized, malformedAuthorityOrPort, malformedReferenceEdge, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = normalizeStringWithStatus(value, opts)
+  return malformedAuthorityOrPort || malformedReferenceEdge || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? undefined : normalized
 }
 
 const fastUri = {

package/lib/schemes.js

@@ -230,7 +230,10 @@ const urn = /** @type {SchemeHandler} */ ({
   scheme: 'urn',
   parse: urnParse,
   serialize: urnSerialize,
-  skipNormalize: true
+  skipNormalize: true,
+  // The NSS is opaque to generic URI path processing. In particular, RFC 2141
+  // and RFC 8141 do not treat slash-delimited dot segments as equivalent.
+  absolutePath: true
 })
 
 const urnuuid = /** @type {SchemeHandler} */ ({
@@ -290,6 +293,7 @@ const DTEXT_IRI = allowSet(DTEXT_ALLOWED, true)
 const HEX_PAIR = /^[\da-f]{2}$/iu
 const MAILTO_DOMAIN_LITERAL = /^\[[\x21-\x5A\x5E-\x7E]*\]$/u
 const MAILTO_DOMAIN_ERROR = 'URI mailto has an invalid recipient domain.'
+const MAILTO_AUTHORITY_ERROR = 'URI mailto must not have an authority component.'
 const HAS_SURROGATE = /[\uD800-\uDFFF]/u
 
 /**
@@ -519,6 +523,27 @@ function mailtoParse (component, options) {
 
   mailtoComponent.query = undefined
 
+  // RFC 6068 defines no authority for the `mailto` scheme. A `mailto://` input
+  // that retains an authority and also carries recipients (from the path or a
+  // `to=` hfield) folds a leading "/" into the recipient local part on the
+  // next parse; the generic serializer then reinserts a "/" before that path
+  // on every pass, so serialize(parse(x)) is not a fixpoint and a
+  // renormalize-to-fixpoint loop accretes one "%2F" per pass. Drop the
+  // retained authority so the parse -> serialize round trip is stable. A bare
+  // `mailto://host` with no recipients is left as-is: it is idempotent and host
+  // normalization for skip-normalize schemes stays intact.
+  if (
+    to.length > 0 &&
+    (mailtoComponent.userinfo !== undefined ||
+      mailtoComponent.host !== undefined ||
+      mailtoComponent.port !== undefined)
+  ) {
+    mailtoComponent.userinfo = undefined
+    mailtoComponent.host = undefined
+    mailtoComponent.port = undefined
+    mailtoComponent.error = mailtoComponent.error || MAILTO_AUTHORITY_ERROR
+  }
+
   for (let i = 0; i < to.length; i++) {
     const rawAddr = to[i]
     const atIdx = rawAddr.lastIndexOf('@')
@@ -583,6 +608,14 @@ function mailtoSerialize (component, options) {
   mailtoComponent.headers = headers
 
   if (to.length) {
+    // RFC 6068 defines no authority for the `mailto` scheme. If an
+    // application constructs a component with both an authority and recipients,
+    // drop the authority before the generic serializer can insert a "/" path
+    // separator that becomes part of the first recipient on the next parse.
+    mailtoComponent.userinfo = undefined
+    mailtoComponent.host = undefined
+    mailtoComponent.port = undefined
+
     for (let i = 0; i < to.length; i++) {
       const addr = String(to[i])
       const atIdx = addr.lastIndexOf('@')

package/lib/utils.js

@@ -24,6 +24,12 @@ const isQueryFragmentCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&
 /** @type {(value: string) => boolean} */
 const isUserinfoCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:]$/u)
 
+/** @type {(value: string) => boolean} */
+const isRegNameCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=]$/u)
+
+/** @type {(value: string) => boolean} */
+const isLiteralRegName = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=]*$/u)
+
 /**
  * @param {Array<string>} input
  * @returns {string}
@@ -347,23 +353,27 @@ function removeDotSegments (path) {
 }
 
 /**
- * Re-escape RFC 3986 gen-delims that must not appear literally in the host.
- * After the URI regex parses, these characters cannot be literal in the host
- * field, so any that appear after decoding came from percent-encoding and
- * must be restored to prevent authority structure changes.
+ * Encodes a host according to the RFC 3986 host grammar. Valid IP literals
+ * have already been checked by `normalizeIPv6`, so their address separators
+ * remain literal. Every other host is a reg-name and may contain only
+ * unreserved characters, sub-delimiters, and valid percent escapes.
  *
  * @param {string} host
- * @param {boolean} isIP - true for IPv4/IPv6 hosts (skip colon re-escaping)
+ * @param {boolean} isIP - true for a validated IPv4/IPv6 host
+ * @param {boolean} [allowNonAscii=false] - preserve non-ASCII IRI characters
  * @returns {string}
  */
-const HOST_DELIMS = { '@': '%40', '/': '%2F', '?': '%3F', '#': '%23', ':': '%3A' }
-const HOST_DELIM_RE = /[@/?#:]/g
-const HOST_DELIM_NO_COLON_RE = /[@/?#]/g
-
-function reescapeHostDelimiters (host, isIP) {
-  const re = isIP ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE
-  re.lastIndex = 0
-  return host.replace(re, (ch) => HOST_DELIMS[ch])
+const IP_HOST_DELIMS = { '@': '%40', '/': '%2F', '?': '%3F', '#': '%23' }
+const IP_HOST_DELIM_RE = /[@/?#]/g
+
+function encodeHost (host, isIP, allowNonAscii = false) {
+  if (!isIP) {
+    if (isLiteralRegName(host)) return host
+    return encodeComponent(host, isRegNameCharacter, allowNonAscii)
+  }
+
+  IP_HOST_DELIM_RE.lastIndex = 0
+  return host.replace(IP_HOST_DELIM_RE, (ch) => IP_HOST_DELIMS[ch])
 }
 
 /**
@@ -626,9 +636,10 @@ function normalizeQueryFragmentEncoding (input) {
  *
  * @param {string} input
  * @param {(value: string) => boolean} isAllowed
+ * @param {boolean} [allowNonAscii=false]
  * @returns {string}
  */
-function encodeComponent (input, isAllowed) {
+function encodeComponent (input, isAllowed, allowNonAscii = false) {
   let output = ''
 
   for (let i = 0; i < input.length; i++) {
@@ -649,17 +660,19 @@ function encodeComponent (input, isAllowed) {
       if (code < 0x80) {
         output += BYTE_HEX[code]
       } else if (code < 0xD800 || code > 0xDFFF) {
-        output += percentEncodeNonAscii(code)
+        output += allowNonAscii ? ch : percentEncodeNonAscii(code)
       } else if (code <= 0xDBFF && i + 1 < input.length) {
         const low = input.charCodeAt(i + 1)
         if (low >= 0xDC00 && low <= 0xDFFF) {
-          output += percentEncodeNonAscii(0x10000 + ((code - 0xD800) << 10) + (low - 0xDC00))
+          output += allowNonAscii
+            ? ch + input[i + 1]
+            : percentEncodeNonAscii(0x10000 + ((code - 0xD800) << 10) + (low - 0xDC00))
           i++
         } else {
-          output += percentEncodeNonAscii(0xFFFD)
+          output += allowNonAscii ? '\uFFFD' : percentEncodeNonAscii(0xFFFD)
         }
       } else {
-        output += percentEncodeNonAscii(0xFFFD)
+        output += allowNonAscii ? '\uFFFD' : percentEncodeNonAscii(0xFFFD)
       }
     }
   }
@@ -773,9 +786,10 @@ function recomposeZonedIPv6Host (component) {
 
 /**
  * @param {import('../types/index').URIComponent} component
+ * @param {boolean} [allowNonAscii=false] - preserve non-ASCII IRI characters
  * @returns {string|undefined}
  */
-function recomposeAuthority (component) {
+function recomposeAuthority (component, allowNonAscii = false) {
   const uriTokens = []
 
   if (component.userinfo !== undefined) {
@@ -808,7 +822,7 @@ function recomposeAuthority (component) {
         if (ipV6res.isIPV6 === true || ipV6res.isIPVFuture === true) {
           host = `[${ipV6res.escapedHost}]`
         } else {
-          host = reescapeHostDelimiters(host, false)
+          host = encodeHost(host, false, allowNonAscii)
         }
       }
     }
@@ -833,7 +847,7 @@ module.exports = {
   nonSimpleDomain,
   nonSimpleMailtoDomain,
   recomposeAuthority,
-  reescapeHostDelimiters,
+  encodeHost,
   normalizePercentEncoding,
   normalizePathEncoding,
   serializePathEncoding,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fast-uri",
   "description": "Dependency-free RFC 3986 URI toolbox",
-  "version": "4.2.0",
+  "version": "4.2.2",
   "main": "index.js",
   "type": "commonjs",
   "types": "types/index.d.ts",
@@ -61,7 +61,7 @@
     "ajv": "^8.16.0",
     "eslint": "^9.17.0",
     "neostandard": "^0.13.0",
-    "playwright-test": "^14.1.12",
+    "playwright-test": "^15.0.1",
     "tape": "^5.8.1",
     "tstyche": "^7.0.0"
   }

package/test/c0-reference-security.test.js

@@ -0,0 +1,137 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+const EDGE_ERROR = 'URI must not contain leading or trailing C0 controls or spaces.'
+const C0_OR_SPACE = Array.from({ length: 0x21 }, (_, code) => String.fromCharCode(code))
+
+test('parse rejects leading and trailing C0 controls or spaces', (t) => {
+  t.plan(C0_OR_SPACE.length * 2)
+
+  for (const character of C0_OR_SPACE) {
+    t.equal(fastURI.parse(character + 'relative').error, EDGE_ERROR, `leading U+${hex(character)}`)
+    t.equal(fastURI.parse('relative' + character).error, EDGE_ERROR, `trailing U+${hex(character)}`)
+  }
+})
+
+test('normalize preserves references with leading or trailing C0 controls or spaces', (t) => {
+  t.plan(C0_OR_SPACE.length * 2)
+
+  for (const character of C0_OR_SPACE) {
+    const leading = character + '//evil.example/path'
+    const trailing = '//evil.example/path' + character
+    t.equal(fastURI.normalize(leading), leading, `leading U+${hex(character)}`)
+    t.equal(fastURI.normalize(trailing), trailing, `trailing U+${hex(character)}`)
+  }
+})
+
+test('equal rejects references with leading or trailing C0 controls or spaces', (t) => {
+  t.plan(C0_OR_SPACE.length * 2)
+
+  for (const character of C0_OR_SPACE) {
+    const leading = character + 'relative'
+    const trailing = 'relative' + character
+    t.equal(fastURI.equal(leading, leading), false, `leading U+${hex(character)}`)
+    t.equal(fastURI.equal(trailing, trailing), false, `trailing U+${hex(character)}`)
+  }
+})
+
+test('resolve rejects leading and trailing C0 controls or spaces in either input', (t) => {
+  t.plan(C0_OR_SPACE.length * 4)
+
+  for (const character of C0_OR_SPACE) {
+    t.throws(
+      () => fastURI.resolve(character + 'http://base.example/', 'relative'),
+      /leading or trailing C0 controls or spaces/,
+      `leading base U+${hex(character)}`
+    )
+    t.throws(
+      () => fastURI.resolve('http://base.example/' + character, 'relative'),
+      /leading or trailing C0 controls or spaces/,
+      `trailing base U+${hex(character)}`
+    )
+    t.throws(
+      () => fastURI.resolve('http://base.example/', character + '//evil.example/path'),
+      /URI (authority introducer must not contain whitespace|must not contain leading or trailing C0 controls or spaces)/,
+      `leading relative U+${hex(character)}`
+    )
+    t.throws(
+      () => fastURI.resolve('http://base.example/', '//evil.example/path' + character),
+      /leading or trailing C0 controls or spaces/,
+      `trailing relative U+${hex(character)}`
+    )
+  }
+})
+
+test('suffix parsing checks the original reference edges', (t) => {
+  const options = { reference: 'suffix', scheme: 'http' }
+
+  t.equal(fastURI.parse('\u0000example', options).error, EDGE_ERROR, 'leading edge before suffix prefixing')
+  t.equal(fastURI.parse('example\u0020', options).error, EDGE_ERROR, 'trailing edge before suffix prefixing')
+  t.equal(fastURI.normalize('\u0000example', options), '\u0000example', 'normalize preserves a malformed suffix')
+  t.equal(fastURI.equal('example\u0020', 'example\u0020', options), false, 'equal rejects a malformed suffix')
+  t.end()
+})
+
+test('interior and percent-encoded C0 controls or spaces remain data', (t) => {
+  t.plan(C0_OR_SPACE.length * 6)
+
+  for (const character of C0_OR_SPACE) {
+    const encoded = percentEncode(character)
+    const interior = 'a' + character + 'b'
+    const leadingEncoded = encoded + '//evil.example/path'
+    const trailingEncoded = '//evil.example/path' + encoded
+
+    t.equal(fastURI.parse(interior).error, undefined, `interior U+${hex(character)}`)
+    t.equal(fastURI.normalize(interior), 'a' + encoded + 'b', `normalize interior U+${hex(character)}`)
+    t.equal(fastURI.parse(leadingEncoded).error, undefined, `encoded leading U+${hex(character)}`)
+    t.equal(fastURI.normalize(leadingEncoded), leadingEncoded, `normalize encoded leading U+${hex(character)}`)
+    t.equal(fastURI.parse(trailingEncoded).error, undefined, `encoded trailing U+${hex(character)}`)
+    t.equal(fastURI.normalize(trailingEncoded), trailingEncoded, `normalize encoded trailing U+${hex(character)}`)
+  }
+})
+
+test('structured component data remains trusted and is encoded', (t) => {
+  t.equal(fastURI.serialize({ path: '\u0000' }), '%00', 'serialize encodes a path-edge control')
+  t.equal(fastURI.normalize({ path: '\u0020' }).path, '%20', 'object normalization encodes a path-edge space')
+  t.end()
+})
+
+test('resolve rejects an empty host for HTTP and HTTPS results', (t) => {
+  const cases = [
+    ['http://base.example/', '///evil.example'],
+    ['https://base.example/', '////evil.example'],
+    ['http://base.example/', '//'],
+    ['http:///evil.example', ''],
+    ['http://base.example/', '///evil.example', { scheme: 'null' }]
+  ]
+
+  t.plan(cases.length + 2)
+  for (const [base, relative, options] of cases) {
+    t.throws(
+      () => fastURI.resolve(base, relative, options),
+      /HTTP URIs must have a host/,
+      `${base} + ${relative}`
+    )
+  }
+
+  t.equal(
+    fastURI.resolve('http://base.example/', '//other.example/path'),
+    'http://other.example/path',
+    'a non-empty HTTP authority remains valid'
+  )
+  t.equal(
+    fastURI.resolve('uri://base.example/', '///path'),
+    'uri:///path',
+    'generic schemes may retain an empty authority'
+  )
+})
+
+function hex (character) {
+  return character.charCodeAt(0).toString(16).toUpperCase().padStart(4, '0')
+}
+
+function percentEncode (character) {
+  return '%' + character.charCodeAt(0).toString(16).toUpperCase().padStart(2, '0')
+}

package/test/host-encoding.test.js

@@ -0,0 +1,60 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+const C0_OR_SPACE = Array.from({ length: 0x21 }, (_, code) => String.fromCharCode(code))
+
+function percentEncode (character) {
+  return '%' + character.charCodeAt(0).toString(16).toUpperCase().padStart(2, '0')
+}
+
+test('host normalization percent-encodes interior C0 controls and spaces', (t) => {
+  t.plan(C0_OR_SPACE.length * 3)
+
+  for (const character of C0_OR_SPACE) {
+    const input = `custom://a${character}b.example/path`
+    const encodedHost = `a${percentEncode(character)}b.example`
+    const expected = `custom://${encodedHost}/path`
+
+    t.equal(fastURI.parse(input).host, encodedHost, `parse U+${percentEncode(character).slice(1)}`)
+    t.equal(fastURI.normalize(input), expected, `normalize U+${percentEncode(character).slice(1)}`)
+    t.equal(
+      fastURI.resolve('custom://base.example/', `//a${character}b.example/path`),
+      expected,
+      `resolve U+${percentEncode(character).slice(1)}`
+    )
+  }
+})
+
+test('host serialization enforces the RFC 3986 reg-name grammar', (t) => {
+  const forbidden = '"<>[\\]^`{|}\x7F:/?#@%'
+  const expected = '%22%3C%3E%5B%5C%5D%5E%60%7B%7C%7D%7F%3A%2F%3F%23%40%25'
+
+  t.equal(
+    fastURI.serialize({ scheme: 'custom', host: forbidden, path: '/path' }),
+    `custom://${expected}/path`,
+    'forbidden ASCII host characters are percent-encoded'
+  )
+  t.equal(
+    fastURI.serialize({ scheme: 'custom', host: "AZaz09-._~!$&'()*+,;=%2f" }),
+    "custom://AZaz09-._~!$&'()*+,;=%2F",
+    'unreserved characters, sub-delimiters, and valid escapes are preserved'
+  )
+  t.end()
+})
+
+test('host encoding preserves URI and IRI behavior', (t) => {
+  const input = 'custom://résumé.example/path'
+  const encoded = 'custom://r%C3%A9sum%C3%A9.example/path'
+
+  t.equal(fastURI.normalize(input), encoded, 'URI host uses UTF-8 percent-encoding')
+  t.equal(fastURI.normalize(input, { unicodeSupport: true }), input, 'IRI host preserves non-ASCII characters')
+  t.equal(fastURI.normalize(encoded), encoded, 'encoded host normalization is idempotent')
+  t.equal(
+    fastURI.normalize('custom://safe\r\nevil.example/path'),
+    'custom://safe%0D%0Aevil.example/path',
+    'CRLF is not emitted literally'
+  )
+  t.end()
+})

package/test/mailto-authority-security.test.js

@@ -0,0 +1,125 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+// GHSA-88VG-QFHM-JX5Q: `mailto://h/a` carries an authority (which RFC 6068 does
+// not define for `mailto`) and a path. `mailtoParse` used to retain that
+// authority and fold the path's leading "/" into the recipient local part; the
+// generic serializer then reinserted a "/" separator on every pass, so
+// serialize(parse(x)) was not a fixpoint and normalize() accreted one "%2F" per
+// pass (unbounded growth for a renormalize-to-fixpoint consumer).
+
+const authorityForms = [
+  ['mailto://h/a', 'mailto:%2Fa@'],
+  ['mailto://h/a@b', 'mailto:%2Fa@b'],
+  ['mailto://h/', 'mailto:%2F@'],
+  ['mailto://h/a,b', 'mailto:%2Fa@,b@'],
+  ['mailto://user@h/a', 'mailto:%2Fa@'],
+  ['mailto://h:8080/a', 'mailto:%2Fa@'],
+  ['mailto://', 'mailto://'],
+  // recipients can come from a `to=` hfield even when the path is empty
+  ['mailto://h?to=x@y', 'mailto:x@y'],
+  ['mailto://h?to=x@y&to=a@b', 'mailto:x@y,a@b']
+]
+
+test('mailto with a retained authority and a path normalizes to a fixpoint', (t) => {
+  t.plan(authorityForms.length * 2)
+
+  for (const [input] of authorityForms) {
+    const once = fastURI.normalize(input)
+    const twice = fastURI.normalize(once)
+
+    t.equal(twice, once, input + ' normalize is idempotent')
+    t.equal(fastURI.equal(input, once), true, input + ' equals its normalized form')
+  }
+})
+
+test('mailto serialize(parse()) is a stable round trip for the authority form', (t) => {
+  t.plan(authorityForms.length)
+
+  for (const [input, expected] of authorityForms) {
+    t.equal(fastURI.serialize(fastURI.parse(input)), expected, input + ' round trips to a stable value')
+  }
+})
+
+test('mailto authority form does not grow without bound under renormalization', (t) => {
+  // A renormalize-to-fixpoint loop must terminate instead of growing forever.
+  // A single normalize call already terminates, so this guards the fixpoint.
+  const inputs = ['mailto://h/a', 'mailto://h/a@b', 'mailto://h/a,b']
+
+  t.plan(inputs.length * 2)
+
+  for (const input of inputs) {
+    const first = fastURI.normalize(input)
+    let s = input
+    let iters = 0
+    let stable = false
+    while (iters < 1000) {
+      const next = fastURI.normalize(s)
+      if (next === s) {
+        stable = true
+        break
+      }
+      s = next
+      iters++
+    }
+
+    t.equal(stable, true, input + ' reaches a fixpoint')
+    t.equal(s.length, first.length, input + ' does not grow')
+  }
+})
+
+test('mailto authority handling preserves host normalization for skip-normalize schemes', (t) => {
+  // Regression: a bare `mailto://host` with no path must keep its host and stay
+  // idempotent, so the generic host normalization path is unaffected.
+  const encodedHost = 'mailto://%41.com'
+  const literalHost = 'mailto://a.com'
+
+  t.equal(fastURI.parse(encodedHost).host, fastURI.parse(literalHost).host, 'parse results have consistent hosts')
+  t.equal(fastURI.normalize(encodedHost), fastURI.normalize(literalHost), 'normalize results are consistent')
+  t.equal(fastURI.equal(encodedHost, literalHost), true, 'encoded and literal hosts compare equal')
+  t.equal(fastURI.normalize(literalHost), literalHost, 'bare authority mailto is idempotent')
+  t.end()
+})
+
+test('mailto authority form is reported as malformed on the parsed component', (t) => {
+  t.equal(
+    fastURI.parse('mailto://h/a').error,
+    'URI mailto must not have an authority component.',
+    'the retained authority is surfaced as an error'
+  )
+
+  // A valid, authority-free mailto must not be flagged.
+  t.equal(fastURI.parse('mailto:user@host.com').error, undefined, 'well-formed mailto has no error')
+  t.end()
+})
+
+test('mailto serializer drops caller-supplied authority when recipients are present', (t) => {
+  t.equal(
+    fastURI.serialize({ scheme: 'mailto', host: 'h', to: ['a@b'] }),
+    'mailto:a@b',
+    'authority is dropped for direct recipients'
+  )
+  t.equal(
+    fastURI.serialize({ scheme: 'mailto', userinfo: 'u', host: 'h', port: 8080, to: ['a@b'] }),
+    'mailto:a@b',
+    'userinfo, host, and port are dropped for direct recipients'
+  )
+  t.equal(
+    fastURI.serialize({ scheme: 'mailto', host: 'h', headers: { to: 'a@b' } }),
+    'mailto:a@b',
+    'authority is dropped for recipients supplied through a to hfield'
+  )
+  t.equal(
+    fastURI.serialize({ scheme: 'mailto', host: 'h', to: ['a@b'], subject: 'hello' }),
+    'mailto:a@b?subject=hello',
+    'dropping authority preserves header fields'
+  )
+  t.equal(
+    fastURI.serialize({ scheme: 'mailto', host: 'h' }),
+    'mailto://h',
+    'bare authority without recipients remains idempotent'
+  )
+  t.end()
+})

package/test/parse.test.js

@@ -3,6 +3,8 @@
 const test = require('tape')
 const fastURI = require('..')
 
+const EDGE_ERROR = 'URI must not contain leading or trailing C0 controls or spaces.'
+
 test('URI parse', (t) => {
   let components
 
@@ -92,7 +94,7 @@ test('URI parse', (t) => {
 
   // fragment with character tabulation
   components = fastURI.parse('#\t')
-  t.equal(components.error, undefined, 'path errors')
+  t.equal(components.error, EDGE_ERROR, 'fragment with trailing tab is malformed')
   t.equal(components.scheme, undefined, 'scheme')
   // t.equal(components.authority, undefined, "authority");
   t.equal(components.userinfo, undefined, 'userinfo')
@@ -104,7 +106,7 @@ test('URI parse', (t) => {
 
   // fragment with line feed
   components = fastURI.parse('#\n')
-  t.equal(components.error, undefined, 'path errors')
+  t.equal(components.error, EDGE_ERROR, 'fragment with trailing line feed is malformed')
   t.equal(components.scheme, undefined, 'scheme')
   // t.equal(components.authority, undefined, "authority");
   t.equal(components.userinfo, undefined, 'userinfo')
@@ -116,7 +118,7 @@ test('URI parse', (t) => {
 
   // fragment with line tabulation
   components = fastURI.parse('#\v')
-  t.equal(components.error, undefined, 'path errors')
+  t.equal(components.error, EDGE_ERROR, 'fragment with trailing vertical tab is malformed')
   t.equal(components.scheme, undefined, 'scheme')
   // t.equal(components.authority, undefined, "authority");
   t.equal(components.userinfo, undefined, 'userinfo')
@@ -128,7 +130,7 @@ test('URI parse', (t) => {
 
   // fragment with form feed
   components = fastURI.parse('#\f')
-  t.equal(components.error, undefined, 'path errors')
+  t.equal(components.error, EDGE_ERROR, 'fragment with trailing form feed is malformed')
   t.equal(components.scheme, undefined, 'scheme')
   // t.equal(components.authority, undefined, "authority");
   t.equal(components.userinfo, undefined, 'userinfo')
@@ -140,7 +142,7 @@ test('URI parse', (t) => {
 
   // fragment with carriage return
   components = fastURI.parse('#\r')
-  t.equal(components.error, undefined, 'path errors')
+  t.equal(components.error, EDGE_ERROR, 'fragment with trailing carriage return is malformed')
   t.equal(components.scheme, undefined, 'scheme')
   // t.equal(components.authority, undefined, "authority");
   t.equal(components.userinfo, undefined, 'userinfo')

package/test/security.test.js

@@ -202,8 +202,8 @@ test('resolve applies domain canonicalisation only when the effective scheme opt
   t.plan(2)
   t.equal(
     fastURI.resolve('uri://trusted.example/', `//${host}/`),
-    `uri://${host}/`,
-    'an unsupported scheme preserves the host'
+    'uri://ex%C2%ADample.com/',
+    'a generic URI encodes the host without applying domain canonicalisation'
   )
   t.equal(
     fastURI.resolve('http://trusted.example/', `//${host}/`, { unicodeSupport: true }),

package/test/uri-js.test.js

@@ -3,6 +3,8 @@
 const test = require('tape')
 const fastURI = require('..')
 
+const EDGE_ERROR = 'URI must not contain leading or trailing C0 controls or spaces.'
+
 /**
  * URI.js
  *
@@ -126,7 +128,7 @@ test('URI Parsing', (t) => {
 
   // fragment with character tabulation
   components = fastURI.parse('#\t')
-  t.equal(components.error, undefined, 'path errors')
+  t.equal(components.error, EDGE_ERROR, 'fragment with trailing tab is malformed')
   t.equal(components.scheme, undefined, 'scheme')
   t.equal(components.userinfo, undefined, 'userinfo')
   t.equal(components.host, undefined, 'host')
@@ -137,7 +139,7 @@ test('URI Parsing', (t) => {
 
   // fragment with line feed
   components = fastURI.parse('#\n')
-  t.equal(components.error, undefined, 'path errors')
+  t.equal(components.error, EDGE_ERROR, 'fragment with trailing line feed is malformed')
   t.equal(components.scheme, undefined, 'scheme')
   t.equal(components.userinfo, undefined, 'userinfo')
   t.equal(components.host, undefined, 'host')
@@ -148,7 +150,7 @@ test('URI Parsing', (t) => {
 
   // fragment with line tabulation
   components = fastURI.parse('#\v')
-  t.equal(components.error, undefined, 'path errors')
+  t.equal(components.error, EDGE_ERROR, 'fragment with trailing vertical tab is malformed')
   t.equal(components.scheme, undefined, 'scheme')
   t.equal(components.userinfo, undefined, 'userinfo')
   t.equal(components.host, undefined, 'host')
@@ -159,7 +161,7 @@ test('URI Parsing', (t) => {
 
   // fragment with form feed
   components = fastURI.parse('#\f')
-  t.equal(components.error, undefined, 'path errors')
+  t.equal(components.error, EDGE_ERROR, 'fragment with trailing form feed is malformed')
   t.equal(components.scheme, undefined, 'scheme')
   t.equal(components.userinfo, undefined, 'userinfo')
   t.equal(components.host, undefined, 'host')
@@ -170,7 +172,7 @@ test('URI Parsing', (t) => {
 
   // fragment with carriage return
   components = fastURI.parse('#\r')
-  t.equal(components.error, undefined, 'path errors')
+  t.equal(components.error, EDGE_ERROR, 'fragment with trailing carriage return is malformed')
   t.equal(components.scheme, undefined, 'scheme')
   t.equal(components.userinfo, undefined, 'userinfo')
   t.equal(components.host, undefined, 'host')

package/test/urn-full-input.test.js

@@ -27,3 +27,21 @@ test('URN parsing preserves the complete RFC 2141 NSS', (t) => {
 
   t.end()
 })
+
+test('URN serialization preserves NSS dot segments', (t) => {
+  const urnWithDotSegments = 'urn:example:a/b/../c'
+  const destructiveDotSegments = 'urn:example:../../../etc/passwd'
+
+  t.equal(fastURI.serialize(fastURI.parse(urnWithDotSegments)), urnWithDotSegments, 'parsed NSS round-trips unchanged')
+  t.equal(
+    fastURI.serialize({ scheme: 'urn', nid: 'example', nss: '../../../etc/passwd' }),
+    destructiveDotSegments,
+    'structured NSS retains leading dot segments'
+  )
+  t.equal(fastURI.normalize(urnWithDotSegments), urnWithDotSegments, 'normalization retains interior dot segments')
+  t.equal(fastURI.normalize(destructiveDotSegments), destructiveDotSegments, 'normalization retains leading dot segments')
+  t.equal(fastURI.resolve('', urnWithDotSegments), urnWithDotSegments, 'resolution retains NSS dot segments')
+  t.equal(fastURI.equal(urnWithDotSegments, 'urn:example:a/c'), false, 'distinct NSS values do not compare equal')
+
+  t.end()
+})