tldts 7.3.0 → 7.3.1

package/dist/cjs/index.js

@@ -431,7 +431,10 @@ function extractHostname(url, urlIsValidHostname, validate = false) {
                     else if (code < 48 || code > 57) {
                         // < 64 and not a delimiter/dot/digit => only '-' (45) is a valid
                         // host char here; everything else (space, %, !, etc.) is invalid.
-                        if (code !== 45) {
+                        // A '-' must also not START a label (the byte right after a '.') —
+                        // mirrors is-valid.ts; the first label is covered by the first-char
+                        // rule above. (RFC 1034 §3.5 / RFC 1035 §2.3.1 LDH.)
+                        if (code !== 45 || vLastCode === 46 /* label-leading '-' */) {
                             vValid = false;
                         }
                     }
@@ -711,8 +714,14 @@ function isValidHostname (hostname) {
             }
             lastDotIndex = i;
         }
-        else if (!( /*@__INLINE__*/(isValidAscii(code) || code === 45 || code === 95))) {
-            // Check if there is a forbidden character in the label
+        else if (
+        // A forbidden character in the label...
+        !( /*@__INLINE__*/(isValidAscii(code) || code === 45 || code === 95)) ||
+            // ...or a '-' starting a label (the byte right after a '.'). A label must
+            // not begin with a hyphen (RFC 1034 §3.5 / RFC 1035 §2.3.1 LDH, as amended
+            // by RFC 1123 §2.1; cf. UTS #46 CheckHyphens). The first label is covered by
+            // the leading-character guard above; mirrors the trailing-'-' rule below.
+            (code === 45 && lastCharCode === 46)) {
             return false;
         }
         lastCharCode = code;