Skip to content

Commit ac43ca8

Browse files
rodneyrehmrodneyrehm
committed
fix(parse): more backslash galore #410
issue reported privately by @ready-research via https://huntr.dev/
1 parent 622db6d commit ac43ca8

File tree

2 files changed

+346
-0
lines changed

2 files changed

+346
-0
lines changed

‎src/URI.js‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -512,6 +512,9 @@
512512
string = string.substring(0, pos);
513513
}
514514

515+
// slashes and backslashes have lost all meaning for the web protocols (https, http, wss, ws)
516+
string = string.replace(/^(https?|ftp|wss?)?:[/\\]*/, '$1://');
517+
515518
// extract protocol
516519
if (string.substring(0, 2) === '//') {
517520
// relative-scheme

‎test/urls.js‎

Lines changed: 343 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2131,6 +2131,349 @@ var urls = [{
21312131
idn: false,
21322132
punycode: false
21332133
}
2134+
}, {
2135+
name: 'backslashes protocol excessive',
2136+
url: 'https:/\/\/\attacker.com',
2137+
_url: 'https://attacker.com/',
2138+
parts: {
2139+
protocol: 'https',
2140+
username: null,
2141+
password: null,
2142+
hostname: 'attacker.com',
2143+
port: null,
2144+
path: '/',
2145+
query: null,
2146+
fragment: null
2147+
},
2148+
accessors: {
2149+
protocol: 'https',
2150+
username: '',
2151+
password: '',
2152+
port: '',
2153+
path: '/',
2154+
query: '',
2155+
fragment: '',
2156+
resource: '/',
2157+
authority: 'attacker.com',
2158+
origin: 'https://attacker.com',
2159+
userinfo: '',
2160+
subdomain: '',
2161+
domain: 'attacker.com',
2162+
tld: 'com',
2163+
directory: '/',
2164+
filename: '',
2165+
suffix: '',
2166+
hash: '',
2167+
search: '',
2168+
host: 'attacker.com',
2169+
hostname: 'attacker.com'
2170+
},
2171+
is: {
2172+
urn: false,
2173+
url: true,
2174+
relative: false,
2175+
name: true,
2176+
sld: false,
2177+
ip: false,
2178+
ip4: false,
2179+
ip6: false,
2180+
idn: false,
2181+
punycode: false
2182+
}
2183+
}, {
2184+
name: 'no slash protocol https',
2185+
url: 'https:attacker.com',
2186+
_url: 'https://attacker.com/',
2187+
parts: {
2188+
protocol: 'https',
2189+
username: null,
2190+
password: null,
2191+
hostname: 'attacker.com',
2192+
port: null,
2193+
path: '/',
2194+
query: null,
2195+
fragment: null
2196+
},
2197+
accessors: {
2198+
protocol: 'https',
2199+
username: '',
2200+
password: '',
2201+
port: '',
2202+
path: '/',
2203+
query: '',
2204+
fragment: '',
2205+
resource: '/',
2206+
authority: 'attacker.com',
2207+
origin: 'https://attacker.com',
2208+
userinfo: '',
2209+
subdomain: '',
2210+
domain: 'attacker.com',
2211+
tld: 'com',
2212+
directory: '/',
2213+
filename: '',
2214+
suffix: '',
2215+
hash: '',
2216+
search: '',
2217+
host: 'attacker.com',
2218+
hostname: 'attacker.com'
2219+
},
2220+
is: {
2221+
urn: false,
2222+
url: true,
2223+
relative: false,
2224+
name: true,
2225+
sld: false,
2226+
ip: false,
2227+
ip4: false,
2228+
ip6: false,
2229+
idn: false,
2230+
punycode: false
2231+
}
2232+
}, {
2233+
name: 'single slash protocol https',
2234+
url: 'https:/attacker.com',
2235+
_url: 'https://attacker.com/',
2236+
parts: {
2237+
protocol: 'https',
2238+
username: null,
2239+
password: null,
2240+
hostname: 'attacker.com',
2241+
port: null,
2242+
path: '/',
2243+
query: null,
2244+
fragment: null
2245+
},
2246+
accessors: {
2247+
protocol: 'https',
2248+
username: '',
2249+
password: '',
2250+
port: '',
2251+
path: '/',
2252+
query: '',
2253+
fragment: '',
2254+
resource: '/',
2255+
authority: 'attacker.com',
2256+
origin: 'https://attacker.com',
2257+
userinfo: '',
2258+
subdomain: '',
2259+
domain: 'attacker.com',
2260+
tld: 'com',
2261+
directory: '/',
2262+
filename: '',
2263+
suffix: '',
2264+
hash: '',
2265+
search: '',
2266+
host: 'attacker.com',
2267+
hostname: 'attacker.com'
2268+
},
2269+
is: {
2270+
urn: false,
2271+
url: true,
2272+
relative: false,
2273+
name: true,
2274+
sld: false,
2275+
ip: false,
2276+
ip4: false,
2277+
ip6: false,
2278+
idn: false,
2279+
punycode: false
2280+
}
2281+
}, {
2282+
name: 'excessive slash protocol https',
2283+
url: 'https://////attacker.com',
2284+
_url: 'https://attacker.com/',
2285+
parts: {
2286+
protocol: 'https',
2287+
username: null,
2288+
password: null,
2289+
hostname: 'attacker.com',
2290+
port: null,
2291+
path: '/',
2292+
query: null,
2293+
fragment: null
2294+
},
2295+
accessors: {
2296+
protocol: 'https',
2297+
username: '',
2298+
password: '',
2299+
port: '',
2300+
path: '/',
2301+
query: '',
2302+
fragment: '',
2303+
resource: '/',
2304+
authority: 'attacker.com',
2305+
origin: 'https://attacker.com',
2306+
userinfo: '',
2307+
subdomain: '',
2308+
domain: 'attacker.com',
2309+
tld: 'com',
2310+
directory: '/',
2311+
filename: '',
2312+
suffix: '',
2313+
hash: '',
2314+
search: '',
2315+
host: 'attacker.com',
2316+
hostname: 'attacker.com'
2317+
},
2318+
is: {
2319+
urn: false,
2320+
url: true,
2321+
relative: false,
2322+
name: true,
2323+
sld: false,
2324+
ip: false,
2325+
ip4: false,
2326+
ip6: false,
2327+
idn: false,
2328+
punycode: false
2329+
}
2330+
}, {
2331+
name: 'no slash protocol ftp',
2332+
url: 'ftp:attacker.com',
2333+
_url: 'ftp://attacker.com/',
2334+
parts: {
2335+
protocol: 'ftp',
2336+
username: null,
2337+
password: null,
2338+
hostname: 'attacker.com',
2339+
port: null,
2340+
path: '/',
2341+
query: null,
2342+
fragment: null
2343+
},
2344+
accessors: {
2345+
protocol: 'ftp',
2346+
username: '',
2347+
password: '',
2348+
port: '',
2349+
path: '/',
2350+
query: '',
2351+
fragment: '',
2352+
resource: '/',
2353+
authority: 'attacker.com',
2354+
origin: 'ftp://attacker.com',
2355+
userinfo: '',
2356+
subdomain: '',
2357+
domain: 'attacker.com',
2358+
tld: 'com',
2359+
directory: '/',
2360+
filename: '',
2361+
suffix: '',
2362+
hash: '',
2363+
search: '',
2364+
host: 'attacker.com',
2365+
hostname: 'attacker.com'
2366+
},
2367+
is: {
2368+
urn: false,
2369+
url: true,
2370+
relative: false,
2371+
name: true,
2372+
sld: false,
2373+
ip: false,
2374+
ip4: false,
2375+
ip6: false,
2376+
idn: false,
2377+
punycode: false
2378+
}
2379+
}, {
2380+
name: 'single slash protocol ftp',
2381+
url: 'ftp:/attacker.com',
2382+
_url: 'ftp://attacker.com/',
2383+
parts: {
2384+
protocol: 'ftp',
2385+
username: null,
2386+
password: null,
2387+
hostname: 'attacker.com',
2388+
port: null,
2389+
path: '/',
2390+
query: null,
2391+
fragment: null
2392+
},
2393+
accessors: {
2394+
protocol: 'ftp',
2395+
username: '',
2396+
password: '',
2397+
port: '',
2398+
path: '/',
2399+
query: '',
2400+
fragment: '',
2401+
resource: '/',
2402+
authority: 'attacker.com',
2403+
origin: 'ftp://attacker.com',
2404+
userinfo: '',
2405+
subdomain: '',
2406+
domain: 'attacker.com',
2407+
tld: 'com',
2408+
directory: '/',
2409+
filename: '',
2410+
suffix: '',
2411+
hash: '',
2412+
search: '',
2413+
host: 'attacker.com',
2414+
hostname: 'attacker.com'
2415+
},
2416+
is: {
2417+
urn: false,
2418+
url: true,
2419+
relative: false,
2420+
name: true,
2421+
sld: false,
2422+
ip: false,
2423+
ip4: false,
2424+
ip6: false,
2425+
idn: false,
2426+
punycode: false
2427+
}
2428+
}, {
2429+
name: 'excessive slash protocol ftp',
2430+
url: 'ftp://////attacker.com',
2431+
_url: 'ftp://attacker.com/',
2432+
parts: {
2433+
protocol: 'ftp',
2434+
username: null,
2435+
password: null,
2436+
hostname: 'attacker.com',
2437+
port: null,
2438+
path: '/',
2439+
query: null,
2440+
fragment: null
2441+
},
2442+
accessors: {
2443+
protocol: 'ftp',
2444+
username: '',
2445+
password: '',
2446+
port: '',
2447+
path: '/',
2448+
query: '',
2449+
fragment: '',
2450+
resource: '/',
2451+
authority: 'attacker.com',
2452+
origin: 'ftp://attacker.com',
2453+
userinfo: '',
2454+
subdomain: '',
2455+
domain: 'attacker.com',
2456+
tld: 'com',
2457+
directory: '/',
2458+
filename: '',
2459+
suffix: '',
2460+
hash: '',
2461+
search: '',
2462+
host: 'attacker.com',
2463+
hostname: 'attacker.com'
2464+
},
2465+
is: {
2466+
urn: false,
2467+
url: true,
2468+
relative: false,
2469+
name: true,
2470+
sld: false,
2471+
ip: false,
2472+
ip4: false,
2473+
ip6: false,
2474+
idn: false,
2475+
punycode: false
2476+
}
21342477
}, {
21352478
name: '__proto__ in query',
21362479
url: 'http://www.example.org/?__proto__=hasOwnProperty&__proto__=eviltwin&uuid',

0 commit comments

Comments
 (0)