File tree 2 files changed +55
-3
lines changed
2 files changed +55
-3
lines changed Original file line number Diff line number Diff line change 612
612
} ;
613
613
URI . parseUserinfo = function ( string , parts ) {
614
614
// extract username:password
615
+ var _string = string
615
616
var firstBackSlash = string . indexOf ( '\\' ) ;
617
+ if ( firstBackSlash !== - 1 ) {
618
+ string = string . replace ( / \\ / g, '/' )
619
+ }
616
620
var firstSlash = string . indexOf ( '/' ) ;
617
- var slash = firstBackSlash === - 1 ? firstSlash : ( firstSlash !== - 1 ? Math . min ( firstBackSlash , firstSlash ) : firstSlash )
618
621
var pos = string . lastIndexOf ( '@' , firstSlash > - 1 ? firstSlash : string . length - 1 ) ;
619
622
var t ;
620
623
621
624
// authority@ must come before /path or \path
622
- if ( pos > - 1 && ( slash === - 1 || pos < slash ) ) {
625
+ if ( pos > - 1 && ( firstSlash === - 1 || pos < firstSlash ) ) {
623
626
t = string . substring ( 0 , pos ) . split ( ':' ) ;
624
627
parts . username = t [ 0 ] ? URI . decode ( t [ 0 ] ) : null ;
625
628
t . shift ( ) ;
626
629
parts . password = t [ 0 ] ? URI . decode ( t . join ( ':' ) ) : null ;
627
- string = string . substring ( pos + 1 ) ;
630
+ string = _string . substring ( pos + 1 ) ;
628
631
} else {
629
632
parts . username = null ;
630
633
parts . password = null ;
Original file line number Diff line number Diff line change @@ -2033,6 +2033,55 @@ var urls = [{
2033
2033
idn : false ,
2034
2034
punycode : false
2035
2035
}
2036
+ } , {
2037
+ name : 'backslashes authority, no ending slash' ,
2038
+ url : 'https://attacker.com\\@example.com' ,
2039
+ _url : 'https://attacker.com/@example.com' ,
2040
+ parts : {
2041
+ protocol : 'https' ,
2042
+ username : null ,
2043
+ password : null ,
2044
+ hostname : 'attacker.com' ,
2045
+ port : null ,
2046
+ path : '/@example.com' ,
2047
+ query : null ,
2048
+ fragment : null
2049
+ } ,
2050
+ accessors : {
2051
+ protocol : 'https' ,
2052
+ username : '' ,
2053
+ password : '' ,
2054
+ port : '' ,
2055
+ path : '/@example.com' ,
2056
+ query : '' ,
2057
+ fragment : '' ,
2058
+ resource : '/@example.com' ,
2059
+ authority : 'attacker.com' ,
2060
+ origin : 'https://attacker.com' ,
2061
+ userinfo : '' ,
2062
+ subdomain : '' ,
2063
+ domain : 'attacker.com' ,
2064
+ tld : 'com' ,
2065
+ directory : '/' ,
2066
+ filename : '@example.com' ,
2067
+ suffix : 'com' ,
2068
+ hash : '' ,
2069
+ search : '' ,
2070
+ host : 'attacker.com' ,
2071
+ hostname : 'attacker.com'
2072
+ } ,
2073
+ is : {
2074
+ urn : false ,
2075
+ url : true ,
2076
+ relative : false ,
2077
+ name : true ,
2078
+ sld : false ,
2079
+ ip : false ,
2080
+ ip4 : false ,
2081
+ ip6 : false ,
2082
+ idn : false ,
2083
+ punycode : false
2084
+ }
2036
2085
}
2037
2086
] ;
2038
2087
You can’t perform that action at this time.
0 commit comments