File tree 2 files changed +53
-2
lines changed
2 files changed +53
-2
lines changed Original file line number Diff line number Diff line change 612
612
} ;
613
613
URI . parseUserinfo = function ( string , parts ) {
614
614
// extract username:password
615
+ var firstBackSlash = string . indexOf ( '\\' ) ;
615
616
var firstSlash = string . indexOf ( '/' ) ;
617
+ var slash = firstBackSlash === - 1 ? firstSlash : ( firstSlash !== - 1 ? Math . min ( firstBackSlash , firstSlash ) : firstSlash )
616
618
var pos = string . lastIndexOf ( '@' , firstSlash > - 1 ? firstSlash : string . length - 1 ) ;
617
619
var t ;
618
620
619
- // authority@ must come before /path
620
- if ( pos > - 1 && ( firstSlash === - 1 || pos < firstSlash ) ) {
621
+ // authority@ must come before /path or \path
622
+ if ( pos > - 1 && ( slash === - 1 || pos < slash ) ) {
621
623
t = string . substring ( 0 , pos ) . split ( ':' ) ;
622
624
parts . username = t [ 0 ] ? URI . decode ( t [ 0 ] ) : null ;
623
625
t . shift ( ) ;
Original file line number Diff line number Diff line change @@ -1984,6 +1984,55 @@ var urls = [{
1984
1984
idn : false ,
1985
1985
punycode : false
1986
1986
}
1987
+ } , {
1988
+ name : 'backslashes authority' ,
1989
+ url : 'https://attacker.com\\@example.com/some/directory/file.html?query=string#fragment' ,
1990
+ _url : 'https://attacker.com/@example.com/some/directory/file.html?query=string#fragment' ,
1991
+ parts : {
1992
+ protocol : 'https' ,
1993
+ username : null ,
1994
+ password : null ,
1995
+ hostname : 'attacker.com' ,
1996
+ port : null ,
1997
+ path : '/@example.com/some/directory/file.html' ,
1998
+ query : 'query=string' ,
1999
+ fragment : 'fragment'
2000
+ } ,
2001
+ accessors : {
2002
+ protocol : 'https' ,
2003
+ username : '' ,
2004
+ password : '' ,
2005
+ port : '' ,
2006
+ path : '/@example.com/some/directory/file.html' ,
2007
+ query : 'query=string' ,
2008
+ fragment : 'fragment' ,
2009
+ resource : '/@example.com/some/directory/file.html?query=string#fragment' ,
2010
+ authority : 'attacker.com' ,
2011
+ origin : 'https://attacker.com' ,
2012
+ userinfo : '' ,
2013
+ subdomain : '' ,
2014
+ domain : 'attacker.com' ,
2015
+ tld : 'com' ,
2016
+ directory : '/@example.com/some/directory' ,
2017
+ filename : 'file.html' ,
2018
+ suffix : 'html' ,
2019
+ hash : '#fragment' ,
2020
+ search : '?query=string' ,
2021
+ host : 'attacker.com' ,
2022
+ hostname : 'attacker.com'
2023
+ } ,
2024
+ is : {
2025
+ urn : false ,
2026
+ url : true ,
2027
+ relative : false ,
2028
+ name : true ,
2029
+ sld : false ,
2030
+ ip : false ,
2031
+ ip4 : false ,
2032
+ ip6 : false ,
2033
+ idn : false ,
2034
+ punycode : false
2035
+ }
1987
2036
}
1988
2037
] ;
1989
2038
You can’t perform that action at this time.
0 commit comments