tldts-tests 7.4.21 → 7.4.23
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cjs/src/tldts-tests.js +21 -0
- package/dist/cjs/src/tldts-tests.js.map +1 -1
- package/dist/cjs/tsconfig.tsbuildinfo +1 -1
- package/dist/es6/src/tldts-tests.js +21 -0
- package/dist/es6/src/tldts-tests.js.map +1 -1
- package/dist/es6/tsconfig.bundle.tsbuildinfo +1 -1
- package/package.json +3 -3
- package/src/tldts-tests.ts +21 -0
package/src/tldts-tests.ts
CHANGED
|
@@ -1662,6 +1662,19 @@ export default function test(
|
|
|
1662
1662
|
expect(tldts.getHostname('http://example.com\\@evil.com')).to.equal(
|
|
1663
1663
|
'example.com',
|
|
1664
1664
|
);
|
|
1665
|
+
// Same for scheme-relative and scheme-less input, which a browser
|
|
1666
|
+
// resolves against an http(s) base.
|
|
1667
|
+
for (const url of [
|
|
1668
|
+
'//evil.com\\@good.com',
|
|
1669
|
+
'\\\\evil.com\\@good.com',
|
|
1670
|
+
'http:@evil.com\\@good.com',
|
|
1671
|
+
'ht\rtps://evil.com\\@good.com', // CR is stripped, not a scheme char
|
|
1672
|
+
'evil.com\\@good.com', // scheme-less: '\' ends the host like '/'
|
|
1673
|
+
]) {
|
|
1674
|
+
expect(tldts.getHostname(url), url).to.equal('evil.com');
|
|
1675
|
+
}
|
|
1676
|
+
// Never the smuggled host (lenient "scheme:port" => the scheme word).
|
|
1677
|
+
expect(tldts.getHostname('http:16909060\\@good.com')).to.equal('http');
|
|
1665
1678
|
});
|
|
1666
1679
|
|
|
1667
1680
|
it('parses a special scheme written without "//"', () => {
|
|
@@ -1705,6 +1718,14 @@ export default function test(
|
|
|
1705
1718
|
expect(tldts.getHostname('javascript:alert(1)')).to.equal(null);
|
|
1706
1719
|
expect(tldts.getHostname('urn:isbn:9780307476463')).to.equal(null);
|
|
1707
1720
|
expect(tldts.getHostname('mailto:example.com')).to.equal(null); // no '@'
|
|
1721
|
+
for (const url of [
|
|
1722
|
+
'javascript:alert(1)%2F%2F@good.com',
|
|
1723
|
+
"javascript:alert(1);':\\@good.com/'",
|
|
1724
|
+
'DATA:,{"ok":true,"pad":"@good.com/"}', // fetch() returns the inline body
|
|
1725
|
+
'DATA://good.com/,pwn',
|
|
1726
|
+
]) {
|
|
1727
|
+
expect(tldts.getHostname(url), url).to.equal(null); // inline payload
|
|
1728
|
+
}
|
|
1708
1729
|
});
|
|
1709
1730
|
|
|
1710
1731
|
it('extracts the host past an empty userinfo', () => {
|