fast-uri 4.2.1 → 4.2.3

package/test/c0-reference-security.test.js

@@ -0,0 +1,137 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+const EDGE_ERROR = 'URI must not contain leading or trailing C0 controls or spaces.'
+const C0_OR_SPACE = Array.from({ length: 0x21 }, (_, code) => String.fromCharCode(code))
+
+test('parse rejects leading and trailing C0 controls or spaces', (t) => {
+  t.plan(C0_OR_SPACE.length * 2)
+
+  for (const character of C0_OR_SPACE) {
+    t.equal(fastURI.parse(character + 'relative').error, EDGE_ERROR, `leading U+${hex(character)}`)
+    t.equal(fastURI.parse('relative' + character).error, EDGE_ERROR, `trailing U+${hex(character)}`)
+  }
+})
+
+test('normalize preserves references with leading or trailing C0 controls or spaces', (t) => {
+  t.plan(C0_OR_SPACE.length * 2)
+
+  for (const character of C0_OR_SPACE) {
+    const leading = character + '//evil.example/path'
+    const trailing = '//evil.example/path' + character
+    t.equal(fastURI.normalize(leading), leading, `leading U+${hex(character)}`)
+    t.equal(fastURI.normalize(trailing), trailing, `trailing U+${hex(character)}`)
+  }
+})
+
+test('equal rejects references with leading or trailing C0 controls or spaces', (t) => {
+  t.plan(C0_OR_SPACE.length * 2)
+
+  for (const character of C0_OR_SPACE) {
+    const leading = character + 'relative'
+    const trailing = 'relative' + character
+    t.equal(fastURI.equal(leading, leading), false, `leading U+${hex(character)}`)
+    t.equal(fastURI.equal(trailing, trailing), false, `trailing U+${hex(character)}`)
+  }
+})
+
+test('resolve rejects leading and trailing C0 controls or spaces in either input', (t) => {
+  t.plan(C0_OR_SPACE.length * 4)
+
+  for (const character of C0_OR_SPACE) {
+    t.throws(
+      () => fastURI.resolve(character + 'http://base.example/', 'relative'),
+      /leading or trailing C0 controls or spaces/,
+      `leading base U+${hex(character)}`
+    )
+    t.throws(
+      () => fastURI.resolve('http://base.example/' + character, 'relative'),
+      /leading or trailing C0 controls or spaces/,
+      `trailing base U+${hex(character)}`
+    )
+    t.throws(
+      () => fastURI.resolve('http://base.example/', character + '//evil.example/path'),
+      /URI (authority introducer must not contain whitespace|must not contain leading or trailing C0 controls or spaces)/,
+      `leading relative U+${hex(character)}`
+    )
+    t.throws(
+      () => fastURI.resolve('http://base.example/', '//evil.example/path' + character),
+      /leading or trailing C0 controls or spaces/,
+      `trailing relative U+${hex(character)}`
+    )
+  }
+})
+
+test('suffix parsing checks the original reference edges', (t) => {
+  const options = { reference: 'suffix', scheme: 'http' }
+
+  t.equal(fastURI.parse('\u0000example', options).error, EDGE_ERROR, 'leading edge before suffix prefixing')
+  t.equal(fastURI.parse('example\u0020', options).error, EDGE_ERROR, 'trailing edge before suffix prefixing')
+  t.equal(fastURI.normalize('\u0000example', options), '\u0000example', 'normalize preserves a malformed suffix')
+  t.equal(fastURI.equal('example\u0020', 'example\u0020', options), false, 'equal rejects a malformed suffix')
+  t.end()
+})
+
+test('interior and percent-encoded C0 controls or spaces remain data', (t) => {
+  t.plan(C0_OR_SPACE.length * 6)
+
+  for (const character of C0_OR_SPACE) {
+    const encoded = percentEncode(character)
+    const interior = 'a' + character + 'b'
+    const leadingEncoded = encoded + '//evil.example/path'
+    const trailingEncoded = '//evil.example/path' + encoded
+
+    t.equal(fastURI.parse(interior).error, undefined, `interior U+${hex(character)}`)
+    t.equal(fastURI.normalize(interior), 'a' + encoded + 'b', `normalize interior U+${hex(character)}`)
+    t.equal(fastURI.parse(leadingEncoded).error, undefined, `encoded leading U+${hex(character)}`)
+    t.equal(fastURI.normalize(leadingEncoded), leadingEncoded, `normalize encoded leading U+${hex(character)}`)
+    t.equal(fastURI.parse(trailingEncoded).error, undefined, `encoded trailing U+${hex(character)}`)
+    t.equal(fastURI.normalize(trailingEncoded), trailingEncoded, `normalize encoded trailing U+${hex(character)}`)
+  }
+})
+
+test('structured component data remains trusted and is encoded', (t) => {
+  t.equal(fastURI.serialize({ path: '\u0000' }), '%00', 'serialize encodes a path-edge control')
+  t.equal(fastURI.normalize({ path: '\u0020' }).path, '%20', 'object normalization encodes a path-edge space')
+  t.end()
+})
+
+test('resolve rejects an empty host for HTTP and HTTPS results', (t) => {
+  const cases = [
+    ['http://base.example/', '///evil.example'],
+    ['https://base.example/', '////evil.example'],
+    ['http://base.example/', '//'],
+    ['http:///evil.example', ''],
+    ['http://base.example/', '///evil.example', { scheme: 'null' }]
+  ]
+
+  t.plan(cases.length + 2)
+  for (const [base, relative, options] of cases) {
+    t.throws(
+      () => fastURI.resolve(base, relative, options),
+      /HTTP URIs must have a host/,
+      `${base} + ${relative}`
+    )
+  }
+
+  t.equal(
+    fastURI.resolve('http://base.example/', '//other.example/path'),
+    'http://other.example/path',
+    'a non-empty HTTP authority remains valid'
+  )
+  t.equal(
+    fastURI.resolve('uri://base.example/', '///path'),
+    'uri:///path',
+    'generic schemes may retain an empty authority'
+  )
+})
+
+function hex (character) {
+  return character.charCodeAt(0).toString(16).toUpperCase().padStart(4, '0')
+}
+
+function percentEncode (character) {
+  return '%' + character.charCodeAt(0).toString(16).toUpperCase().padStart(2, '0')
+}

package/test/host-delimiter-security.test.js

@@ -0,0 +1,94 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+const MALFORMED_HOST_ERROR = 'URI host is malformed.'
+
+const domainHostSchemes = ['http', 'https', 'ws', 'wss']
+
+// Hosts containing ASCII characters that RFC 3986 does not allow in a
+// reg-name. Handing them to the WHATWG URL parser would read "@" as a userinfo
+// delimiter (dropping the data before it) and strip TAB, LF and CR.
+const forbiddenHosts = [
+  'b@evil.example',
+  'ev\til.example',
+  'ev\nil.example',
+  'ev\ril.example',
+  'ev\r\nil.example',
+  'a b.example',
+  'a"b.example',
+  'a<b.example',
+  'a>b.example',
+  'a^b.example',
+  'a`b.example',
+  'a{b.example',
+  'a|b.example',
+  'a}b.example',
+  'a\u007Fb.example',
+  'a\u0000b.example'
+]
+
+test('domain hosts with forbidden ASCII characters fail closed', (t) => {
+  for (const scheme of domainHostSchemes) {
+    for (const host of forbiddenHosts) {
+      const uri = `${scheme}://user@${host}/path`
+      const label = JSON.stringify(uri)
+
+      const parsed = fastURI.parse(uri)
+      t.equal(parsed.error, MALFORMED_HOST_ERROR, `${label} reports a malformed host`)
+      t.notEqual(parsed.host, 'evil.example', `${label} does not report a truncated host`)
+
+      t.equal(fastURI.normalize(uri), uri, `${label} normalizes to itself`)
+      t.equal(fastURI.normalize(uri, { unicodeSupport: true }), uri, `${label} normalizes to itself with unicodeSupport`)
+      t.equal(fastURI.equal(uri, uri), false, `${label} is not comparable`)
+      t.equal(fastURI.equal(uri, `${scheme}://user@evil.example/path`), false, `${label} does not alias the stripped host`)
+
+      t.throws(
+        () => fastURI.resolve(`${scheme}://trusted.example/`, `//user@${host}/path`),
+        /URI host is malformed\./,
+        `${label} is rejected by resolve`
+      )
+    }
+  }
+  t.end()
+})
+
+test('a second "@" cannot move the authority to a different host', (t) => {
+  const uri = 'http://a@b@evil.example/'
+  const parsed = fastURI.parse(uri)
+  t.equal(parsed.userinfo, 'a')
+  t.notEqual(parsed.host, 'evil.example', 'host is not silently truncated')
+  t.equal(parsed.error, MALFORMED_HOST_ERROR)
+  t.equal(fastURI.normalize(uri), uri)
+
+  t.throws(
+    () => fastURI.resolve('http://trusted.example/', '//a@b%41@evil.example/p'),
+    /URI host is malformed\./,
+    'percent-encoded data does not bypass the check in resolve'
+  )
+  t.end()
+})
+
+test('the domainHost option applies the same rules to other schemes', (t) => {
+  const parsed = fastURI.parse('foo://a@b@evil.example/', { domainHost: true })
+  t.equal(parsed.error, MALFORMED_HOST_ERROR)
+  t.end()
+})
+
+test('valid domain hosts are unaffected', (t) => {
+  t.equal(fastURI.normalize('http://Example.COM/'), 'http://example.com/')
+  t.equal(fastURI.normalize('http://%65xample.com/'), 'http://example.com/')
+  t.equal(fastURI.normalize('http://bücher.de/'), 'http://xn--bcher-kva.de/')
+  t.equal(fastURI.normalize('http://bücher.de/', { unicodeSupport: true }), 'http://bücher.de/')
+  t.equal(fastURI.parse("http://a!$&'()*+,;=b.example/").error, undefined, 'sub-delims are allowed')
+  t.equal(fastURI.parse('http://user:pass@example.com:8080/').host, 'example.com')
+  t.equal(fastURI.resolve('http://trusted.example/', '//user@example.com/p'), 'http://user@example.com/p')
+  t.end()
+})
+
+test('schemes without domain hosts keep encoding reg-name data', (t) => {
+  t.equal(fastURI.normalize('foo://a@b@evil.example/'), 'foo://a@b%40evil.example/')
+  t.equal(fastURI.resolve('foo://x/', '//a@b@evil.example/p'), 'foo://a@b%40evil.example/p')
+  t.end()
+})

package/test/host-encoding.test.js

@@ -0,0 +1,60 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+const C0_OR_SPACE = Array.from({ length: 0x21 }, (_, code) => String.fromCharCode(code))
+
+function percentEncode (character) {
+  return '%' + character.charCodeAt(0).toString(16).toUpperCase().padStart(2, '0')
+}
+
+test('host normalization percent-encodes interior C0 controls and spaces', (t) => {
+  t.plan(C0_OR_SPACE.length * 3)
+
+  for (const character of C0_OR_SPACE) {
+    const input = `custom://a${character}b.example/path`
+    const encodedHost = `a${percentEncode(character)}b.example`
+    const expected = `custom://${encodedHost}/path`
+
+    t.equal(fastURI.parse(input).host, encodedHost, `parse U+${percentEncode(character).slice(1)}`)
+    t.equal(fastURI.normalize(input), expected, `normalize U+${percentEncode(character).slice(1)}`)
+    t.equal(
+      fastURI.resolve('custom://base.example/', `//a${character}b.example/path`),
+      expected,
+      `resolve U+${percentEncode(character).slice(1)}`
+    )
+  }
+})
+
+test('host serialization enforces the RFC 3986 reg-name grammar', (t) => {
+  const forbidden = '"<>[\\]^`{|}\x7F:/?#@%'
+  const expected = '%22%3C%3E%5B%5C%5D%5E%60%7B%7C%7D%7F%3A%2F%3F%23%40%25'
+
+  t.equal(
+    fastURI.serialize({ scheme: 'custom', host: forbidden, path: '/path' }),
+    `custom://${expected}/path`,
+    'forbidden ASCII host characters are percent-encoded'
+  )
+  t.equal(
+    fastURI.serialize({ scheme: 'custom', host: "AZaz09-._~!$&'()*+,;=%2f" }),
+    "custom://AZaz09-._~!$&'()*+,;=%2F",
+    'unreserved characters, sub-delimiters, and valid escapes are preserved'
+  )
+  t.end()
+})
+
+test('host encoding preserves URI and IRI behavior', (t) => {
+  const input = 'custom://résumé.example/path'
+  const encoded = 'custom://r%C3%A9sum%C3%A9.example/path'
+
+  t.equal(fastURI.normalize(input), encoded, 'URI host uses UTF-8 percent-encoding')
+  t.equal(fastURI.normalize(input, { unicodeSupport: true }), input, 'IRI host preserves non-ASCII characters')
+  t.equal(fastURI.normalize(encoded), encoded, 'encoded host normalization is idempotent')
+  t.equal(
+    fastURI.normalize('custom://safe\r\nevil.example/path'),
+    'custom://safe%0D%0Aevil.example/path',
+    'CRLF is not emitted literally'
+  )
+  t.end()
+})

package/test/parse.test.js

@@ -3,6 +3,8 @@
 const test = require('tape')
 const fastURI = require('..')
 
+const EDGE_ERROR = 'URI must not contain leading or trailing C0 controls or spaces.'
+
 test('URI parse', (t) => {
   let components
 
@@ -92,7 +94,7 @@ test('URI parse', (t) => {
 
   // fragment with character tabulation
   components = fastURI.parse('#\t')
-  t.equal(components.error, undefined, 'path errors')
+  t.equal(components.error, EDGE_ERROR, 'fragment with trailing tab is malformed')
   t.equal(components.scheme, undefined, 'scheme')
   // t.equal(components.authority, undefined, "authority");
   t.equal(components.userinfo, undefined, 'userinfo')
@@ -104,7 +106,7 @@ test('URI parse', (t) => {
 
   // fragment with line feed
   components = fastURI.parse('#\n')
-  t.equal(components.error, undefined, 'path errors')
+  t.equal(components.error, EDGE_ERROR, 'fragment with trailing line feed is malformed')
   t.equal(components.scheme, undefined, 'scheme')
   // t.equal(components.authority, undefined, "authority");
   t.equal(components.userinfo, undefined, 'userinfo')
@@ -116,7 +118,7 @@ test('URI parse', (t) => {
 
   // fragment with line tabulation
   components = fastURI.parse('#\v')
-  t.equal(components.error, undefined, 'path errors')
+  t.equal(components.error, EDGE_ERROR, 'fragment with trailing vertical tab is malformed')
   t.equal(components.scheme, undefined, 'scheme')
   // t.equal(components.authority, undefined, "authority");
   t.equal(components.userinfo, undefined, 'userinfo')
@@ -128,7 +130,7 @@ test('URI parse', (t) => {
 
   // fragment with form feed
   components = fastURI.parse('#\f')
-  t.equal(components.error, undefined, 'path errors')
+  t.equal(components.error, EDGE_ERROR, 'fragment with trailing form feed is malformed')
   t.equal(components.scheme, undefined, 'scheme')
   // t.equal(components.authority, undefined, "authority");
   t.equal(components.userinfo, undefined, 'userinfo')
@@ -140,7 +142,7 @@ test('URI parse', (t) => {
 
   // fragment with carriage return
   components = fastURI.parse('#\r')
-  t.equal(components.error, undefined, 'path errors')
+  t.equal(components.error, EDGE_ERROR, 'fragment with trailing carriage return is malformed')
   t.equal(components.scheme, undefined, 'scheme')
   // t.equal(components.authority, undefined, "authority");
   t.equal(components.userinfo, undefined, 'userinfo')

package/test/relative-normalization-security.test.js

@@ -0,0 +1,152 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+const ABSOLUTE_BASES = [
+  'http://h/p/q/r',
+  'http://h/',
+  'foo://h/a/b/',
+  'http://h/p/q/'
+]
+
+const RELATIVE_BASES = ['', 'base', 'relative/base']
+
+test('normalize keeps the meaning of relative-path references', (t) => {
+  const cases = [
+    ['a/../b', 'b'],
+    ['x/..', './'],
+    ['../x', '../x'],
+    ['./../x', '../x'],
+    ['a/b/../../..', '..'],
+    ['a/./b', 'a/b'],
+    ['a/b/..', 'a/'],
+    ['.', './'],
+    ['..', '..'],
+    ['../', '../'],
+    ['../../a/./b/../c', '../../a/c'],
+    ['a//..', 'a/'],
+    ['a/../b?q#f', 'b?q#f']
+  ]
+  for (const [input, expected] of cases) {
+    t.equal(fastURI.normalize(input), expected, `${input} -> ${expected}`)
+  }
+  t.end()
+})
+
+test('normalize never turns a relative-path reference into a root or network path', (t) => {
+  t.equal(fastURI.normalize('.//x'), './/x', 'leading empty segment is kept behind "."')
+  t.equal(fastURI.normalize('a/..//x'), './/x', 'collapsed prefix does not expose "//"')
+  t.equal(fastURI.parse(fastURI.normalize('a/..//x')).host, undefined, 'no authority is introduced')
+  t.equal(fastURI.normalize('./a:b'), './a:b', 'first-segment colon is kept behind a "." segment (RFC 3986 section 4.2)')
+  t.equal(fastURI.parse(fastURI.normalize('./a:b')).scheme, undefined, 'no scheme is introduced')
+  t.end()
+})
+
+test('normalize keeps the existing behavior for root-relative and absolute paths', (t) => {
+  t.equal(fastURI.normalize('/a/../b'), '/b')
+  t.equal(fastURI.normalize('/../x'), '/x')
+  t.equal(fastURI.normalize('http://h/a/../../b'), 'http://h/b')
+  t.end()
+})
+
+test('equal does not alias relative references with different targets', (t) => {
+  t.equal(fastURI.equal('../x', 'x'), false)
+  t.equal(fastURI.equal('a/../b', '/b'), false)
+  t.equal(fastURI.equal('x/..', '/'), false)
+  t.equal(fastURI.equal('a/../b', 'b'), true)
+  t.end()
+})
+
+test('resolving a normalized relative reference matches resolving the original', (t) => {
+  for (const base of [...ABSOLUTE_BASES, ...RELATIVE_BASES]) {
+    for (const ref of ['a/../b', 'x/..', '../x', './../x', 'a/b/../../..', '.', '..', './/x']) {
+      t.equal(
+        fastURI.resolve(base, fastURI.normalize(ref)),
+        fastURI.resolve(base, ref),
+        `${base} + ${ref}`
+      )
+    }
+  }
+  t.equal(fastURI.resolve('http://h/p/q/r', fastURI.normalize('a/../b')), 'http://h/p/q/b')
+  t.equal(fastURI.resolve('http://h/p/q/r', fastURI.normalize('../x')), 'http://h/p/x')
+  t.end()
+})
+
+test('property: normalization of relative references is resolution-preserving and idempotent', (t) => {
+  const segments = ['a', 'b', '.', '..', '', 'a:b']
+  // Deterministic linear congruential generator so failures are reproducible.
+  let seed = 0x5ec02
+  const next = (n) => {
+    seed = (seed * 1103515245 + 12345) % 2147483648
+    return Math.floor((seed / 2147483648) * n)
+  }
+
+  let failures = 0
+  let checked = 0
+  for (let i = 0; i < 4000; i++) {
+    const length = 1 + next(6)
+    const parts = []
+    for (let j = 0; j < length; j++) parts.push(segments[next(segments.length)])
+    const ref = parts.join('/')
+    // Only relative-path references: empty refs, refs starting with "/", and
+    // refs whose first segment contains ":" are not affected by this change.
+    if (ref === '' || ref[0] === '/' || fastURI.parse(ref).scheme !== undefined) continue
+
+    checked++
+    const normalized = fastURI.normalize(ref)
+    if (fastURI.normalize(normalized) !== normalized) {
+      failures++
+      t.fail(`not idempotent: ${ref} -> ${normalized} -> ${fastURI.normalize(normalized)}`)
+    }
+    for (const base of ABSOLUTE_BASES) {
+      const expected = fastURI.resolve(base, ref)
+      const actual = fastURI.resolve(base, normalized)
+      if (actual !== expected) {
+        failures++
+        t.fail(`${base} + ${ref}: normalized ${normalized} resolves to ${actual}, expected ${expected}`)
+      }
+    }
+  }
+
+  t.ok(checked > 1000, `checked ${checked} relative references`)
+  t.equal(failures, 0, 'no relative reference changed meaning')
+  t.end()
+})
+
+test('suffix normalization preserves relative path meaning', (t) => {
+  const options = { reference: 'suffix', scheme: 'x' }
+  for (const [input, expected] of [
+    ['a/../b', 'b'],
+    ['x/..', './'],
+    ['a/../a:b', './a:b']
+  ]) {
+    t.equal(fastURI.normalize(input, options), expected, `${input} -> ${expected}`)
+  }
+  t.end()
+})
+
+test('normalize does not promote a colon-first relative reference to a scheme (skipEscape)', (t) => {
+  // RFC 3986 section 4.2: a first path segment containing ":" must stay
+  // protected by a leading "./", or it is mistaken for a scheme. Collapsing
+  // the protecting dot segment must not expose the colon. The default path
+  // escapes the colon; with skipEscape the colon is emitted raw and the
+  // reference is reparsed as absolute (scheme "a"), changing its meaning.
+  const colonRefs = ['./a:b', 'a/../a:b']
+  for (const ref of colonRefs) {
+    const normalized = fastURI.normalize(ref, { skipEscape: true })
+    t.equal(
+      fastURI.parse(normalized).scheme,
+      undefined,
+      `${ref} -> ${normalized} must not introduce a scheme`
+    )
+    for (const base of ABSOLUTE_BASES) {
+      t.equal(
+        fastURI.resolve(base, normalized, { skipEscape: true }),
+        fastURI.resolve(base, ref, { skipEscape: true }),
+        `${base} + ${ref}: normalized ${normalized} must resolve the same`
+      )
+    }
+  }
+  t.end()
+})

package/test/reserved-path-normalization.test.js

@@ -77,13 +77,13 @@ test('serialize uses the RFC 3986 path character set without opening escapes', (
   )
   t.equal(
     fastURI.serialize({ path: './a:b/c:d' }),
-    'a%3Ab/c:d',
-    'escapes a first-segment colon exposed by dot-segment removal'
+    './a:b/c:d',
+    'a first-segment colon exposed by dot-segment removal is kept behind a "." segment'
   )
   t.equal(
     fastURI.normalize('./a:b'),
-    'a%3Ab',
-    'normalization keeps a relative path from becoming a scheme'
+    './a:b',
+    'normalization keeps a relative path from becoming a scheme without re-encoding the colon'
   )
   t.equal(
     fastURI.serialize({ path: '/Kſ' }),
@@ -107,3 +107,31 @@ test('equal distinguishes escaped reserved path data from literal syntax', (t) =
   )
   t.end()
 })
+
+// A suffix reference never emits its scheme token, so it is a scheme-less
+// (path-noscheme) reference: a bare ':' in its first path segment must be
+// escaped, or the serialized output reparses as an absolute URI with a scheme.
+// @see https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp
+test('suffix reference escapes a first-segment colon instead of emitting a scheme', (t) => {
+  const dangerous = /^(?:javascript|data|vbscript):/i
+  const options = { reference: 'suffix', scheme: 'x' }
+
+  for (const input of ['javascript:alert(1)', '%6Aavascript:alert(1)', 'data:text/html,x', 'vbscript:msgbox(1)']) {
+    t.notOk(dangerous.test(fastURI.normalize(input, options)), `${input} normalizes to an inert reference`)
+  }
+
+  t.equal(
+    fastURI.normalize('javascript:alert(1)', options),
+    'javascript%3Aalert(1)',
+    'escapes the leading-segment colon to %3A'
+  )
+  t.notOk(
+    dangerous.test(fastURI.resolve('https://a.example/base/', '%6Aavascript:alert(1)', { reference: 'suffix' })),
+    'resolve in suffix mode does not emit a live scheme'
+  )
+
+  // legitimate suffix usage is unchanged
+  t.equal(fastURI.normalize('path/to/file', options), 'path/to/file', 'plain path unchanged')
+  t.equal(fastURI.normalize('a/b:c', options), 'a/b:c', 'colon in a later segment stays literal')
+  t.end()
+})

package/test/scheme-validation.test.js

@@ -15,7 +15,15 @@ const malformedSchemes = [
   'foo_bar:value',
   'éxample:value',
   'Kttp://example.com/',
-  'ſcheme:value'
+  'ſcheme:value',
+  // RFC 3986 section 3.1 does not allow percent-encoding in a scheme.
+  '%4Aavascript:alert(1)',
+  '%6aavascript:alert(1)',
+  'foo%2Bbar:value',
+  '%u006Aavascript:1',
+  'ht%74ps://example.com/',
+  'ma%69lto:user@example.org',
+  '%64ata:text/html,x'
 ]
 
 test('parse validates the decoded scheme against RFC 3986', (t) => {
@@ -23,10 +31,7 @@ test('parse validates the decoded scheme against RFC 3986', (t) => {
     ['a:value', 'a'],
     ['HTTP://example.com/', 'http'],
     ['a1+.-:value', 'a1+.-'],
-    ['%4Aavascript:alert(1)', 'javascript'],
-    ['foo%2Bbar:value', 'foo+bar'],
-    ['%u006Aavascript:1', 'javascript'],
-    ['ht%74ps://example.com/', 'https']
+    ['foo+bar:value', 'foo+bar']
   ]
 
   for (const [uri, scheme] of validSchemes) {
@@ -42,15 +47,39 @@ test('parse validates the decoded scheme against RFC 3986', (t) => {
   t.end()
 })
 
-test('decoded schemes select their scheme handlers', (t) => {
+test('percent-encoded schemes do not select scheme handlers', (t) => {
   t.equal(
     fastURI.normalize('ht%74ps://example.com:443'),
-    'https://example.com/',
-    'HTTP normalization runs after decoding the scheme'
+    'ht%74ps://example.com:443',
+    'HTTP normalization does not run for an encoded scheme'
   )
 
   const mailto = fastURI.parse('ma%69lto:user@example.org')
-  t.deepEqual(mailto.to, ['user@example.org'], 'mailto parsing runs after decoding the scheme')
+  t.equal(mailto.to, undefined, 'mailto parsing does not run for an encoded scheme')
+  t.equal(mailto.error, MALFORMED_SCHEME_ERROR)
+  t.end()
+})
+
+test('normalization cannot synthesize a scheme from encoded input', (t) => {
+  const inputs = [
+    '%6Aavascript:alert(1)',
+    '%4A%41%56%41%53%43%52%49%50%54:alert(1)',
+    '%u006Aavascript:alert(1)',
+    'j%61vascript:alert(1)',
+    '%64ata:text/html,<script>alert(1)</script>',
+    'vb%73cript:msgbox(1)'
+  ]
+
+  for (const uri of inputs) {
+    const parsed = fastURI.parse(uri)
+    t.equal(parsed.error, MALFORMED_SCHEME_ERROR, uri + ' is malformed')
+    t.notOk(/^(?:javascript|data|vbscript):/i.test(String(parsed.scheme) + ':'), uri + ' parsed scheme is not decoded')
+    t.equal(fastURI.normalize(uri), uri, uri + ' normalizes to itself')
+    t.equal(fastURI.equal(uri, uri), false, uri + ' is not comparable')
+    t.throws(() => fastURI.resolve('https://example.com/app/', uri), /URI scheme is malformed\./, uri + ' is rejected by resolve')
+  }
+
+  t.equal(fastURI.equal('%68ttp://a/', 'http://a/'), false, 'encoded scheme does not alias a plain scheme')
   t.end()
 })
 
@@ -93,11 +122,21 @@ test('resolve rejects malformed decoded schemes in either input', (t) => {
   t.end()
 })
 
-test('serialize validates decoded component schemes', (t) => {
+test('serialize validates component schemes without decoding them', (t) => {
   t.equal(
-    fastURI.serialize({ scheme: 'foo%2Bbar', path: 'value' }),
+    fastURI.serialize({ scheme: 'foo+bar', path: 'value' }),
     'foo+bar:value',
-    'valid decoded scheme is serialized'
+    'valid scheme is serialized'
+  )
+  t.throws(
+    () => fastURI.serialize({ scheme: 'foo%2Bbar', path: 'value' }),
+    /URI scheme is malformed\./,
+    'percent-encoded scheme is rejected'
+  )
+  t.throws(
+    () => fastURI.serialize({ scheme: '%6Aavascript', path: 'alert(1)' }),
+    /URI scheme is malformed\./,
+    'encoded scheme cannot serialize as javascript:'
   )
   t.throws(
     () => fastURI.serialize({ scheme: '//evil.example', path: '/pwn' }),

package/test/security.test.js

@@ -202,8 +202,8 @@ test('resolve applies domain canonicalisation only when the effective scheme opt
   t.plan(2)
   t.equal(
     fastURI.resolve('uri://trusted.example/', `//${host}/`),
-    `uri://${host}/`,
-    'an unsupported scheme preserves the host'
+    'uri://ex%C2%ADample.com/',
+    'a generic URI encodes the host without applying domain canonicalisation'
   )
   t.equal(
     fastURI.resolve('http://trusted.example/', `//${host}/`, { unicodeSupport: true }),