fast-uri 4.2.1 → 4.2.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.github/workflows/release.yml +34 -0
- package/README.md +9 -1
- package/index.js +146 -30
- package/lib/schemes.js +4 -1
- package/lib/utils.js +87 -21
- package/package.json +2 -2
- package/test/c0-reference-security.test.js +137 -0
- package/test/host-delimiter-security.test.js +94 -0
- package/test/host-encoding.test.js +60 -0
- package/test/parse.test.js +7 -5
- package/test/relative-normalization-security.test.js +152 -0
- package/test/reserved-path-normalization.test.js +32 -4
- package/test/scheme-validation.test.js +51 -12
- package/test/security.test.js +2 -2
- package/test/uri-js.test.js +7 -5
- package/test/urn-full-input.test.js +18 -0
package/test/uri-js.test.js
CHANGED
|
@@ -3,6 +3,8 @@
|
|
|
3
3
|
const test = require('tape')
|
|
4
4
|
const fastURI = require('..')
|
|
5
5
|
|
|
6
|
+
const EDGE_ERROR = 'URI must not contain leading or trailing C0 controls or spaces.'
|
|
7
|
+
|
|
6
8
|
/**
|
|
7
9
|
* URI.js
|
|
8
10
|
*
|
|
@@ -126,7 +128,7 @@ test('URI Parsing', (t) => {
|
|
|
126
128
|
|
|
127
129
|
// fragment with character tabulation
|
|
128
130
|
components = fastURI.parse('#\t')
|
|
129
|
-
t.equal(components.error,
|
|
131
|
+
t.equal(components.error, EDGE_ERROR, 'fragment with trailing tab is malformed')
|
|
130
132
|
t.equal(components.scheme, undefined, 'scheme')
|
|
131
133
|
t.equal(components.userinfo, undefined, 'userinfo')
|
|
132
134
|
t.equal(components.host, undefined, 'host')
|
|
@@ -137,7 +139,7 @@ test('URI Parsing', (t) => {
|
|
|
137
139
|
|
|
138
140
|
// fragment with line feed
|
|
139
141
|
components = fastURI.parse('#\n')
|
|
140
|
-
t.equal(components.error,
|
|
142
|
+
t.equal(components.error, EDGE_ERROR, 'fragment with trailing line feed is malformed')
|
|
141
143
|
t.equal(components.scheme, undefined, 'scheme')
|
|
142
144
|
t.equal(components.userinfo, undefined, 'userinfo')
|
|
143
145
|
t.equal(components.host, undefined, 'host')
|
|
@@ -148,7 +150,7 @@ test('URI Parsing', (t) => {
|
|
|
148
150
|
|
|
149
151
|
// fragment with line tabulation
|
|
150
152
|
components = fastURI.parse('#\v')
|
|
151
|
-
t.equal(components.error,
|
|
153
|
+
t.equal(components.error, EDGE_ERROR, 'fragment with trailing vertical tab is malformed')
|
|
152
154
|
t.equal(components.scheme, undefined, 'scheme')
|
|
153
155
|
t.equal(components.userinfo, undefined, 'userinfo')
|
|
154
156
|
t.equal(components.host, undefined, 'host')
|
|
@@ -159,7 +161,7 @@ test('URI Parsing', (t) => {
|
|
|
159
161
|
|
|
160
162
|
// fragment with form feed
|
|
161
163
|
components = fastURI.parse('#\f')
|
|
162
|
-
t.equal(components.error,
|
|
164
|
+
t.equal(components.error, EDGE_ERROR, 'fragment with trailing form feed is malformed')
|
|
163
165
|
t.equal(components.scheme, undefined, 'scheme')
|
|
164
166
|
t.equal(components.userinfo, undefined, 'userinfo')
|
|
165
167
|
t.equal(components.host, undefined, 'host')
|
|
@@ -170,7 +172,7 @@ test('URI Parsing', (t) => {
|
|
|
170
172
|
|
|
171
173
|
// fragment with carriage return
|
|
172
174
|
components = fastURI.parse('#\r')
|
|
173
|
-
t.equal(components.error,
|
|
175
|
+
t.equal(components.error, EDGE_ERROR, 'fragment with trailing carriage return is malformed')
|
|
174
176
|
t.equal(components.scheme, undefined, 'scheme')
|
|
175
177
|
t.equal(components.userinfo, undefined, 'userinfo')
|
|
176
178
|
t.equal(components.host, undefined, 'host')
|
|
@@ -27,3 +27,21 @@ test('URN parsing preserves the complete RFC 2141 NSS', (t) => {
|
|
|
27
27
|
|
|
28
28
|
t.end()
|
|
29
29
|
})
|
|
30
|
+
|
|
31
|
+
test('URN serialization preserves NSS dot segments', (t) => {
|
|
32
|
+
const urnWithDotSegments = 'urn:example:a/b/../c'
|
|
33
|
+
const destructiveDotSegments = 'urn:example:../../../etc/passwd'
|
|
34
|
+
|
|
35
|
+
t.equal(fastURI.serialize(fastURI.parse(urnWithDotSegments)), urnWithDotSegments, 'parsed NSS round-trips unchanged')
|
|
36
|
+
t.equal(
|
|
37
|
+
fastURI.serialize({ scheme: 'urn', nid: 'example', nss: '../../../etc/passwd' }),
|
|
38
|
+
destructiveDotSegments,
|
|
39
|
+
'structured NSS retains leading dot segments'
|
|
40
|
+
)
|
|
41
|
+
t.equal(fastURI.normalize(urnWithDotSegments), urnWithDotSegments, 'normalization retains interior dot segments')
|
|
42
|
+
t.equal(fastURI.normalize(destructiveDotSegments), destructiveDotSegments, 'normalization retains leading dot segments')
|
|
43
|
+
t.equal(fastURI.resolve('', urnWithDotSegments), urnWithDotSegments, 'resolution retains NSS dot segments')
|
|
44
|
+
t.equal(fastURI.equal(urnWithDotSegments, 'urn:example:a/c'), false, 'distinct NSS values do not compare equal')
|
|
45
|
+
|
|
46
|
+
t.end()
|
|
47
|
+
})
|