fast-uri 4.2.1 → 4.2.3

package/.github/workflows/release.yml

@@ -0,0 +1,34 @@
+name: Release the package
+
+on:
+  workflow_dispatch:
+    inputs:
+      semver:
+        description: 'Release bump type'
+        required: true
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
+          - prepatch
+          - preminor
+          - premajor
+          - prerelease
+      preid:
+        description: 'Prerelease identifier (e.g. rc), used by the pre* bump types'
+        required: false
+        type: string
+
+permissions: {}
+
+jobs:
+  release:
+    permissions:
+      id-token: write # required for npm provenance via OIDC
+      contents: write # required to push the release commit and the tag
+    uses: fastify/workflows/.github/workflows/reusable-release.yml@b0a2ab2d8259b6bd574b804cd6874bbd75c3577c
+    with:
+      semver: ${{ inputs.semver }}
+      preid: ${{ inputs.preid }}
+      dist-tag: ${{ startsWith(inputs.semver, 'pre') && 'next' || 'latest' }}

package/README.md

@@ -13,7 +13,11 @@ Dependency-free RFC 3986 URI toolbox.
 
 All of the above functions can accept an additional options argument that is an object that can contain one or more of the following properties:
 
-Malformed authorities and out-of-range ports are reported through the parsed component's `error` field. `normalize()` leaves malformed string inputs unchanged, and `equal()` returns `false` when either string input is malformed.
+Malformed authorities, out-of-range ports, and raw leading or trailing C0 controls or spaces (U+0000–U+0020) are reported through the parsed component's `error` field. `normalize()` leaves these malformed string inputs unchanged, and `equal()` returns `false`. `resolve()` rejects them in either input and rejects HTTP(S) results with an empty host. Percent-encoded and interior component data remain valid.
+
+Schemes are never percent-decoded. RFC 3986 does not allow percent-encoding in a scheme, so an input such as `%6Aavascript:alert(1)` is reported as malformed (`error: 'URI scheme is malformed.'`) instead of being parsed as `javascript:`. `normalize()` leaves it unchanged, `equal()` returns `false`, and `resolve()` and `serialize()` throw.
+
+For schemes with domain hosts (`http`, `https`, `ws`, `wss`, or any scheme with the `domainHost` option), a host containing an ASCII character that RFC 3986 does not allow in a reg-name (for example `@`, TAB, LF, CR, space, `"`, `<`, `>`, `^`, `` ` ``, `{`, `|`, `}`) is reported as malformed (`error: 'URI host is malformed.'`). It is never passed through a WHATWG URL parser that could treat `@` as a delimiter or strip whitespace. `normalize()` leaves such input unchanged, `equal()` returns `false`, and `resolve()` throws.
 
 *	`scheme` (string)
 	Indicates the scheme that the URI should be treated as, overriding the URI's normal scheme parsing behavior.
@@ -21,6 +25,8 @@ Malformed authorities and out-of-range ports are reported through the parsed com
 *	`reference` (string)
 	If set to `"suffix"`, it indicates that the URI is in the suffix format and the parser will use the option's `scheme` property to determine the URI's scheme.
 
+	A suffix reference is written without its scheme and without the `//` authority marker (RFC 3986 section 4.5). Such a reference is inherently ambiguous: an authority component cannot always be distinguished from a path. When the input carries an authority of the form `host:port` (for example `//javascript:80/x`) or a userinfo containing a colon, the serialized suffix output can begin with text that reparses as a URI scheme (for example `javascript:80/x`). Do not treat suffix output as a trusted absolute URL, and do not render it or use it in a scheme allowlist without first validating it with `parse()`. If you need an unambiguous result, use the default (non-suffix) serialization.
+
 *	`tolerant` (boolean, false)
 	If set to `true`, the parser will relax URI resolving rules.
 
@@ -80,6 +86,8 @@ uri.normalize('http://example.com/a%2Fb')
 
 Reserved path escapes such as `%2F` and `%2E` are preserved as path data during normalization and comparison.
 
+Dot segments in relative references are removed without changing what the reference resolves to: leading `..` segments that cannot be collapsed are kept, a relative path is never turned into a root-relative one, and a first-segment colon exposed by the removal is kept behind a leading `./` so the reference is not reparsed as a scheme (`a/../b` → `b`, `../x` → `../x`, `x/..` → `./`, `a/../a:b` → `./a:b`).
+
 ### Equal
 
 ```js

package/index.js

@@ -1,21 +1,29 @@
 'use strict'
 
-const { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require('./lib/utils')
+const { normalizeIPv6, removeDotSegments, removeDotSegmentsRelative, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, encodeHost, isIPv4, nonSimpleDomain } = require('./lib/utils')
 const { SCHEMES, getSchemeHandler } = require('./lib/schemes')
 
 const VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u
 const MALFORMED_SCHEME_ERROR = 'URI scheme is malformed.'
+const MALFORMED_HOST_ERROR = 'URI host is malformed.'
+// ASCII characters outside the RFC 3986 reg-name set (unreserved, sub-delims
+// and "%" for pct-encoded): C0 controls, space, DEL, and "#/:<>?@[\]^`{|}.
+const FORBIDDEN_DOMAIN_HOST_CHARACTER = /[\0-\x20"#/:<>?@[\\\]^`{|}\x7F]/u
 
 /**
+ * RFC 3986 section 3.1 does not allow percent-encoding in a scheme, so the
+ * scheme is validated as-is and never decoded. Decoding would let inert input
+ * such as `%6Aavascript:` become a live `javascript:` scheme.
+ *
  * @param {string} scheme
  * @returns {string}
  */
-function decodeValidScheme (scheme) {
-  const decodedScheme = unescape(String(scheme))
-  if (!VALID_SCHEME.test(decodedScheme)) {
+function validateScheme (scheme) {
+  const stringScheme = String(scheme)
+  if (!VALID_SCHEME.test(stringScheme)) {
     throw new TypeError(MALFORMED_SCHEME_ERROR)
   }
-  return decodedScheme
+  return stringScheme
 }
 
 /**
@@ -44,6 +52,7 @@ function resolve (baseURI, relativeURI, options) {
   const {
     parsed: baseParsed,
     malformedAuthorityOrPort: baseMalformed,
+    malformedReferenceEdge: baseMalformedReferenceEdge,
     malformedPercentEncoding: baseMalformedPercentEncoding,
     malformedSchemeSpecific: baseMalformedSchemeSpecific,
     malformedHost: baseMalformedHost,
@@ -52,6 +61,7 @@ function resolve (baseURI, relativeURI, options) {
   const {
     parsed: relativeParsed,
     malformedAuthorityOrPort: relativeMalformed,
+    malformedReferenceEdge: relativeMalformedReferenceEdge,
     malformedPercentEncoding: relativeMalformedPercentEncoding,
     malformedSchemeSpecific: relativeMalformedSchemeSpecific,
     malformedHost: relativeMalformedHost,
@@ -60,6 +70,8 @@ function resolve (baseURI, relativeURI, options) {
   if (
     baseMalformed ||
     relativeMalformed ||
+    baseMalformedReferenceEdge ||
+    relativeMalformedReferenceEdge ||
     baseMalformedPercentEncoding ||
     relativeMalformedPercentEncoding ||
     baseMalformedSchemeSpecific ||
@@ -74,8 +86,22 @@ function resolve (baseURI, relativeURI, options) {
   const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true)
   const resolvedSchemeHandler = getSchemeHandler((options && options.scheme) || resolved.scheme)
   const resolvedHost = resolved.host
+  // Inputs are parsed scheme-neutrally during resolution, so enforce the final
+  // HTTP scheme's required host before serializing an invalid HTTP URI.
+  if (
+    (resolved.scheme === 'http' || resolved.scheme === 'https') &&
+    !resolvedHost
+  ) {
+    throw new Error('HTTP URIs must have a host.')
+  }
   const resolvedHostIsIP = resolvedHost !== undefined && resolvedHost !== '' &&
     (isIPv4(resolvedHost) || normalizeIPv6(resolvedHost).isIPV6)
+  // Inputs are parsed scheme-neutrally, so delimiters and controls in a domain
+  // host are only detected here, once the final scheme is known. They always
+  // fail closed, including in percent-encoded hosts.
+  if (hasForbiddenDomainHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP)) {
+    throw new Error(MALFORMED_HOST_ERROR)
+  }
   canonicalizeHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP)
   // Percent escapes in an ASCII reg-name are encoded data. The WHATWG hostname
   // parser can reject them even though fast-uri preserves them safely as RFC
@@ -86,6 +112,9 @@ function resolve (baseURI, relativeURI, options) {
     throw new Error(resolved.error)
   }
   schemelessOptions.skipEscape = true
+  if (resolvedSchemeHandler && resolvedSchemeHandler.absolutePath) {
+    schemelessOptions.absolutePath = true
+  }
   return serialize(resolved, schemelessOptions)
 }
 
@@ -127,7 +156,10 @@ function resolveComponent (base, relative, options, skipNormalization) {
     target.userinfo = relative.userinfo
     copyHost(target, relative)
     target.port = relative.port
-    target.path = removeDotSegments(relative.path || '')
+    const relativeSchemeHandler = getSchemeHandler(relative.scheme)
+    target.path = relativeSchemeHandler && relativeSchemeHandler.absolutePath
+      ? relative.path || ''
+      : removeDotSegments(relative.path || '')
     target.query = relative.query
   } else {
     if (relative.userinfo !== undefined || relative.host !== undefined || relative.port !== undefined) {
@@ -149,14 +181,17 @@ function resolveComponent (base, relative, options, skipNormalization) {
         if (relative.path[0] === '/') {
           target.path = removeDotSegments(relative.path)
         } else {
-          if ((base.userinfo !== undefined || base.host !== undefined || base.port !== undefined) && !base.path) {
+          const baseHasAuthority = base.userinfo !== undefined || base.host !== undefined || base.port !== undefined
+          if (baseHasAuthority && !base.path) {
             target.path = '/' + relative.path
           } else if (!base.path) {
             target.path = relative.path
           } else {
             target.path = base.path.slice(0, base.path.lastIndexOf('/') + 1) + relative.path
           }
-          target.path = removeDotSegments(target.path)
+          target.path = base.scheme === undefined && !baseHasAuthority && target.path[0] !== '/'
+            ? removeDotSegmentsRelative(target.path)
+            : removeDotSegments(target.path)
         }
         target.query = relative.query
       }
@@ -217,7 +252,7 @@ function serialize (cmpts, opts) {
   const uriTokens = []
 
   if (component.scheme) {
-    component.scheme = decodeValidScheme(component.scheme)
+    component.scheme = validateScheme(component.scheme)
   }
 
   // find scheme handler
@@ -227,7 +262,11 @@ function serialize (cmpts, opts) {
   if (schemeHandler && schemeHandler.serialize) schemeHandler.serialize(component, options)
 
   const hasAuthority = component.userinfo !== undefined || component.host !== undefined || component.port !== undefined
-  const pathNoScheme = !options.skipEscape && component.scheme === undefined && !hasAuthority
+  // A reference with no emitted scheme is path-noscheme: a bare ':' in its
+  // first path segment would reparse as a scheme (RFC 3986 3.3/4.2). Enforced
+  // under skipEscape too (resolve()), so the reapply below gates on this flag.
+  const schemelessReference = (component.scheme === undefined || options.reference === 'suffix') && !hasAuthority
+  const pathNoScheme = !options.skipEscape && schemelessReference
 
   if (component.path !== undefined) {
     if (!options.skipEscape) {
@@ -239,11 +278,12 @@ function serialize (cmpts, opts) {
 
   if (options.reference !== 'suffix' && component.scheme) {
     // Scheme handlers may replace the scheme during serialization.
-    component.scheme = decodeValidScheme(component.scheme)
+    component.scheme = validateScheme(component.scheme)
     uriTokens.push(component.scheme, ':')
   }
 
-  const authority = recomposeAuthority(component)
+  const allowNonAsciiHost = options.unicodeSupport === true || Boolean(schemeHandler && schemeHandler.unicodeSupport)
+  const authority = recomposeAuthority(component, allowNonAsciiHost)
   if (authority !== undefined) {
     if (options.reference !== 'suffix') {
       uriTokens.push('//')
@@ -259,13 +299,18 @@ function serialize (cmpts, opts) {
     let s = component.path
 
     if (!options.absolutePath && (!schemeHandler || !schemeHandler.absolutePath)) {
-      s = removeDotSegments(s)
+      // A relative-path reference keeps its unresolvable leading ".." segments
+      // and must never become root-relative (RFC 3986 section 5.2.4 applies to
+      // merged target paths, not to the reference itself).
+      s = schemelessReference && s[0] !== '/'
+        ? removeDotSegmentsRelative(s)
+        : removeDotSegments(s)
     }
 
     // Dot-segment removal can expose a colon that was not originally in the
     // first segment (for example, "./a:b"). Reapply path-noscheme encoding so
     // the serialized relative reference cannot be reparsed as a URI scheme.
-    if (pathNoScheme) {
+    if (schemelessReference) {
       s = serializePathEncoding(s, true)
     }
 
@@ -385,6 +430,11 @@ function canonicalizeHost (parsed, options, schemeHandler, isIP) {
     parsed.host[0] === '[' &&
     parsed.host[parsed.host.length - 1] === ']'
 
+  if (hasForbiddenDomainHost(parsed, options, schemeHandler, isIP)) {
+    parsed.error = parsed.error || MALFORMED_HOST_ERROR
+    return true
+  }
+
   if (
     !options.unicodeSupport &&
     (!schemeHandler || !schemeHandler.unicodeSupport) &&
@@ -395,21 +445,67 @@ function canonicalizeHost (parsed, options, schemeHandler, isIP) {
     !bracketedIPLiteral &&
     nonSimpleDomain(parsed.host)
   ) {
+    let url
     try {
-      parsed.host = new URL('http://' + parsed.host).hostname
+      url = new URL('http://' + parsed.host)
     } catch (e) {
       parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e
       return true
     }
+    // The WHATWG parser must have read the whole input as a host. Anything
+    // else means it found a delimiter fast-uri did not, so its hostname would
+    // describe a different authority.
+    if (!isHostOnlyURL(url)) {
+      parsed.error = parsed.error || MALFORMED_HOST_ERROR
+      return true
+    }
+    parsed.host = url.hostname
   }
 
   return false
 }
 
+/**
+ * Whether a domain host contains an ASCII character that RFC 3986 does not
+ * allow in a reg-name (unreserved, sub-delims, or pct-encoded). Such a host is
+ * rejected instead of being handed to the WHATWG URL parser, which would treat
+ * "@" as a userinfo delimiter (silently dropping the data before it) and strip
+ * TAB, LF, and CR. Non-ASCII characters remain allowed for IDNs.
+ *
+ * @param {import('./types/index').URIComponent} parsed
+ * @param {import('./types/index').Options} options
+ * @param {{ domainHost?: boolean }|undefined} schemeHandler
+ * @param {boolean} isIP
+ * @returns {boolean}
+ */
+function hasForbiddenDomainHost (parsed, options, schemeHandler, isIP) {
+  return Boolean(
+    parsed.host &&
+    isIP === false &&
+    !isIPLiteral(parsed.host) &&
+    (options.domainHost || (schemeHandler && schemeHandler.domainHost)) &&
+    FORBIDDEN_DOMAIN_HOST_CHARACTER.test(parsed.host)
+  )
+}
+
+/**
+ * @param {URL} url
+ * @returns {boolean}
+ */
+function isHostOnlyURL (url) {
+  return url.username === '' &&
+    url.password === '' &&
+    url.port === '' &&
+    url.pathname === '/' &&
+    url.search === '' &&
+    url.hash === '' &&
+    url.hostname !== ''
+}
+
 /**
  * @param {string} uri
  * @param {import('./types/index').Options} [opts]
- * @returns {{ parsed: import('./types/index').URIComponent, malformedAuthorityOrPort: boolean, malformedPercentEncoding: boolean, malformedSchemeSpecific: boolean, malformedHost: boolean, malformedScheme: boolean }}
+ * @returns {{ parsed: import('./types/index').URIComponent, malformedAuthorityOrPort: boolean, malformedReferenceEdge: boolean, malformedPercentEncoding: boolean, malformedSchemeSpecific: boolean, malformedHost: boolean, malformedScheme: boolean }}
  */
 function parseWithStatus (uri, opts) {
   const options = Object.assign({}, opts)
@@ -425,6 +521,12 @@ function parseWithStatus (uri, opts) {
   }
 
   let malformedAuthorityOrPort = false
+  // Check the caller's original reference before suffix mode prepends a scheme
+  // or authority marker and turns its leading edge into interior data.
+  const malformedReferenceEdge = uri.length !== 0 && (
+    uri.charCodeAt(0) <= 0x20 ||
+    uri.charCodeAt(uri.length - 1) <= 0x20
+  )
   let malformedPercentEncoding = false
   let malformedSchemeSpecific = false
   let malformedHost = false
@@ -475,6 +577,10 @@ function parseWithStatus (uri, opts) {
     }
   }
 
+  if (malformedReferenceEdge) {
+    parsed.error = parsed.error || 'URI must not contain leading or trailing C0 controls or spaces.'
+  }
+
   const matches = uri.match(URI_PARSE)
 
   if (matches) {
@@ -488,9 +594,8 @@ function parseWithStatus (uri, opts) {
     parsed.fragment = matches[8]
 
     if (parsed.scheme !== undefined) {
-      const decodedScheme = unescape(parsed.scheme)
-      if (VALID_SCHEME.test(decodedScheme)) {
-        parsed.scheme = decodedScheme.toLowerCase()
+      if (VALID_SCHEME.test(parsed.scheme)) {
+        parsed.scheme = parsed.scheme.toLowerCase()
       } else {
         parsed.error = parsed.error || MALFORMED_SCHEME_ERROR
         malformedScheme = true
@@ -534,7 +639,7 @@ function parseWithStatus (uri, opts) {
         }
 
         if (malformedIPLiteral) {
-          parsed.error = parsed.error || 'URI host is malformed.'
+          parsed.error = parsed.error || MALFORMED_HOST_ERROR
           malformedAuthorityOrPort = true
         }
       } else {
@@ -564,14 +669,24 @@ function parseWithStatus (uri, opts) {
       malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP)
     }
 
-    if (uri.indexOf('%') !== -1 && parsed.host !== undefined && !malformedIPLiteral) {
-      let host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true)
-      if (!isIP) {
+    if (parsed.host !== undefined && !malformedIPLiteral) {
+      let host = parsed.host
+      if (uri.indexOf('%') !== -1 && !isIP) {
+        host = normalizePercentEncoding(host, true)
         // Fold reg-name case after decoding unreserved octets. The second
         // pass only restores uppercase hex in escapes that remain encoded.
         host = normalizePercentEncoding(host.toLowerCase())
       }
-      parsed.host = reescapeHostDelimiters(host, isIP)
+      // Resolution parses both inputs with the internal `null` scheme before
+      // the effective scheme is known. Preserve raw host characters for that
+      // intermediate step so the final scheme can apply domain canonicalization;
+      // the resolved authority is encoded when it is serialized.
+      if (options.scheme !== 'null') {
+        const allowNonAsciiHost = options.unicodeSupport === true || Boolean(schemeHandler && schemeHandler.unicodeSupport)
+        parsed.host = encodeHost(host, isIP, allowNonAsciiHost)
+      } else {
+        parsed.host = host
+      }
     }
 
     if (!schemeHandler || (schemeHandler && !schemeHandler.skipNormalize)) {
@@ -596,7 +711,7 @@ function parseWithStatus (uri, opts) {
   } else {
     parsed.error = parsed.error || 'URI can not be parsed.'
   }
-  return { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme }
+  return { parsed, malformedAuthorityOrPort, malformedReferenceEdge, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme }
 }
 
 /**
@@ -620,13 +735,14 @@ function normalizeString (uri, opts) {
 /**
  * @param {string} uri
  * @param {import('./types/index').Options} [opts]
- * @returns {{ normalized: string, malformedAuthorityOrPort: boolean, malformedPercentEncoding: boolean, malformedSchemeSpecific: boolean, malformedHost: boolean, malformedScheme: boolean }}
+ * @returns {{ normalized: string, malformedAuthorityOrPort: boolean, malformedReferenceEdge: boolean, malformedPercentEncoding: boolean, malformedSchemeSpecific: boolean, malformedHost: boolean, malformedScheme: boolean }}
  */
 function normalizeStringWithStatus (uri, opts) {
-  const { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = parseWithStatus(uri, opts)
+  const { parsed, malformedAuthorityOrPort, malformedReferenceEdge, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = parseWithStatus(uri, opts)
   return {
-    normalized: malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? uri : serialize(parsed, opts),
+    normalized: malformedAuthorityOrPort || malformedReferenceEdge || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? uri : serialize(parsed, opts),
     malformedAuthorityOrPort,
+    malformedReferenceEdge,
     malformedPercentEncoding,
     malformedSchemeSpecific,
     malformedHost,
@@ -650,8 +766,8 @@ function normalizeComparableURI (uri, opts) {
   } catch {
     return undefined
   }
-  const { normalized, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = normalizeStringWithStatus(value, opts)
-  return malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? undefined : normalized
+  const { normalized, malformedAuthorityOrPort, malformedReferenceEdge, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = normalizeStringWithStatus(value, opts)
+  return malformedAuthorityOrPort || malformedReferenceEdge || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? undefined : normalized
 }
 
 const fastUri = {

package/lib/schemes.js

@@ -230,7 +230,10 @@ const urn = /** @type {SchemeHandler} */ ({
   scheme: 'urn',
   parse: urnParse,
   serialize: urnSerialize,
-  skipNormalize: true
+  skipNormalize: true,
+  // The NSS is opaque to generic URI path processing. In particular, RFC 2141
+  // and RFC 8141 do not treat slash-delimited dot segments as equivalent.
+  absolutePath: true
 })
 
 const urnuuid = /** @type {SchemeHandler} */ ({

package/lib/utils.js

@@ -24,6 +24,12 @@ const isQueryFragmentCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&
 /** @type {(value: string) => boolean} */
 const isUserinfoCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:]$/u)
 
+/** @type {(value: string) => boolean} */
+const isRegNameCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=]$/u)
+
+/** @type {(value: string) => boolean} */
+const isLiteralRegName = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=]*$/u)
+
 /**
  * @param {Array<string>} input
  * @returns {string}
@@ -347,23 +353,78 @@ function removeDotSegments (path) {
 }
 
 /**
- * Re-escape RFC 3986 gen-delims that must not appear literally in the host.
- * After the URI regex parses, these characters cannot be literal in the host
- * field, so any that appear after decoding came from percent-encoding and
- * must be restored to prevent authority structure changes.
+ * Removes dot segments from the path of a relative reference (a path that does
+ * not start with "/") without changing what it resolves to against any base.
+ * Unlike `removeDotSegments`, leading ".." segments that cannot be collapsed
+ * are kept, the result never becomes root-relative, and a result that would be
+ * empty or start with an empty segment is prefixed with "." (an empty path
+ * means "same document" and a leading "//" would introduce an authority).
+ *
+ * @param {string} path
+ * @returns {string}
+ */
+function removeDotSegmentsRelative (path) {
+  if (path === '' || path[0] === '/') {
+    return removeDotSegments(path)
+  }
+
+  const segments = path.split('/')
+  const last = segments.length - 1
+  /** @type {string[]} */
+  const output = []
+  let trailingDirectory = false
+
+  for (let i = 0; i <= last; i++) {
+    const segment = segments[i]
+    if (segment === '.' || segment === '..') {
+      if (segment === '..') {
+        if (output.length !== 0 && output[output.length - 1] !== '..') {
+          output.pop()
+        } else {
+          output.push('..')
+        }
+      }
+      trailingDirectory = i === last
+    } else {
+      output.push(segment)
+    }
+  }
+
+  if (trailingDirectory && output[output.length - 1] !== '..') {
+    output.push('')
+  }
+  if (output.length === 0 || output[0] === '' || output[0].includes(':')) {
+    // An empty path, a leading empty segment ("//"), or a first segment
+    // containing ":" (which would be mistaken for a scheme, RFC 3986 section
+    // 4.2) must stay behind a "." segment so the reference keeps its meaning.
+    output.unshift('.')
+  }
+
+  return output.join('/')
+}
+
+/**
+ * Encodes a host according to the RFC 3986 host grammar. Valid IP literals
+ * have already been checked by `normalizeIPv6`, so their address separators
+ * remain literal. Every other host is a reg-name and may contain only
+ * unreserved characters, sub-delimiters, and valid percent escapes.
  *
  * @param {string} host
- * @param {boolean} isIP - true for IPv4/IPv6 hosts (skip colon re-escaping)
+ * @param {boolean} isIP - true for a validated IPv4/IPv6 host
+ * @param {boolean} [allowNonAscii=false] - preserve non-ASCII IRI characters
  * @returns {string}
  */
-const HOST_DELIMS = { '@': '%40', '/': '%2F', '?': '%3F', '#': '%23', ':': '%3A' }
-const HOST_DELIM_RE = /[@/?#:]/g
-const HOST_DELIM_NO_COLON_RE = /[@/?#]/g
-
-function reescapeHostDelimiters (host, isIP) {
-  const re = isIP ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE
-  re.lastIndex = 0
-  return host.replace(re, (ch) => HOST_DELIMS[ch])
+const IP_HOST_DELIMS = { '@': '%40', '/': '%2F', '?': '%3F', '#': '%23' }
+const IP_HOST_DELIM_RE = /[@/?#]/g
+
+function encodeHost (host, isIP, allowNonAscii = false) {
+  if (!isIP) {
+    if (isLiteralRegName(host)) return host
+    return encodeComponent(host, isRegNameCharacter, allowNonAscii)
+  }
+
+  IP_HOST_DELIM_RE.lastIndex = 0
+  return host.replace(IP_HOST_DELIM_RE, (ch) => IP_HOST_DELIMS[ch])
 }
 
 /**
@@ -626,9 +687,10 @@ function normalizeQueryFragmentEncoding (input) {
  *
  * @param {string} input
  * @param {(value: string) => boolean} isAllowed
+ * @param {boolean} [allowNonAscii=false]
  * @returns {string}
  */
-function encodeComponent (input, isAllowed) {
+function encodeComponent (input, isAllowed, allowNonAscii = false) {
   let output = ''
 
   for (let i = 0; i < input.length; i++) {
@@ -649,17 +711,19 @@ function encodeComponent (input, isAllowed) {
       if (code < 0x80) {
         output += BYTE_HEX[code]
       } else if (code < 0xD800 || code > 0xDFFF) {
-        output += percentEncodeNonAscii(code)
+        output += allowNonAscii ? ch : percentEncodeNonAscii(code)
       } else if (code <= 0xDBFF && i + 1 < input.length) {
         const low = input.charCodeAt(i + 1)
         if (low >= 0xDC00 && low <= 0xDFFF) {
-          output += percentEncodeNonAscii(0x10000 + ((code - 0xD800) << 10) + (low - 0xDC00))
+          output += allowNonAscii
+            ? ch + input[i + 1]
+            : percentEncodeNonAscii(0x10000 + ((code - 0xD800) << 10) + (low - 0xDC00))
           i++
         } else {
-          output += percentEncodeNonAscii(0xFFFD)
+          output += allowNonAscii ? '\uFFFD' : percentEncodeNonAscii(0xFFFD)
         }
       } else {
-        output += percentEncodeNonAscii(0xFFFD)
+        output += allowNonAscii ? '\uFFFD' : percentEncodeNonAscii(0xFFFD)
       }
     }
   }
@@ -773,9 +837,10 @@ function recomposeZonedIPv6Host (component) {
 
 /**
  * @param {import('../types/index').URIComponent} component
+ * @param {boolean} [allowNonAscii=false] - preserve non-ASCII IRI characters
  * @returns {string|undefined}
  */
-function recomposeAuthority (component) {
+function recomposeAuthority (component, allowNonAscii = false) {
   const uriTokens = []
 
   if (component.userinfo !== undefined) {
@@ -808,7 +873,7 @@ function recomposeAuthority (component) {
         if (ipV6res.isIPV6 === true || ipV6res.isIPVFuture === true) {
           host = `[${ipV6res.escapedHost}]`
         } else {
-          host = reescapeHostDelimiters(host, false)
+          host = encodeHost(host, false, allowNonAscii)
         }
       }
     }
@@ -833,7 +898,7 @@ module.exports = {
   nonSimpleDomain,
   nonSimpleMailtoDomain,
   recomposeAuthority,
-  reescapeHostDelimiters,
+  encodeHost,
   normalizePercentEncoding,
   normalizePathEncoding,
   serializePathEncoding,
@@ -843,6 +908,7 @@ module.exports = {
   encodeFragment,
   escapePreservingEscapes,
   removeDotSegments,
+  removeDotSegmentsRelative,
   isIPv4,
   isUUID,
   normalizeIPv6,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fast-uri",
   "description": "Dependency-free RFC 3986 URI toolbox",
-  "version": "4.2.1",
+  "version": "4.2.3",
   "main": "index.js",
   "type": "commonjs",
   "types": "types/index.d.ts",
@@ -61,7 +61,7 @@
     "ajv": "^8.16.0",
     "eslint": "^9.17.0",
     "neostandard": "^0.13.0",
-    "playwright-test": "^14.1.12",
+    "playwright-test": "^15.0.1",
     "tape": "^5.8.1",
     "tstyche": "^7.0.0"
   }