CVE-2022-24723: Other (NVD-CWE-Other)
value: URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse can be used as a workaround.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 5.3
Published: 2022-03-03T21:15Z
Repository: https://github.com/medialize/uri.js
Language: JavaScript
Files changed: src/URI.js, test/urls.js
Commit date: 2022-03-03 10:51:40 +0100
Commit message: fix(parse): remove leading whitespace

reported by @p0cas via huntr.dev

Diff: diff --git a/src/URI.js b/src/URI.js
index b634e8b..53b115d 100644
--- a/src/URI.js
+++ b/src/URI.js
@@ -237,10 +237,11 @@
     // trim trailing punctuation captured by end RegExp
     trim: /[`!()\[\]{};:'".,<>?«»“”„‘’]+$/,
     // balanced parens inclusion (), [], {}, <>
     parens: /(\([^\)]*\)|\[[^\]]*\]|\{[^}]*\}|<[^>]*>)/g,
   };
+  URI.leading_whitespace_expression = /^[\x00-\x20\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]+/
   // http://www.iana.org/assignments/uri-schemes.html
   // http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers#Well-known_ports
   URI.defaultPorts = {
     http: '80',
     https: '443',
@@ -492,10 +493,13 @@
     if (!parts) {
       parts = {
         preventInvalidHostname: URI.preventInvalidHostname
       };
     }
+
+    string = string.replace(URI.leading_whitespace_expression, '')
+
     // [protocol"://"[username[":"password]"@"]hostname[":"port]"/"?][path]["?"querystring]["#"fragment]
 
     // extract fragment
     pos = string.indexOf('#');
     if (pos > -1) {
diff --git a/test/urls.js b/test/urls.js
index 839f0da..4b077ce 100644
--- a/test/urls.js
+++ b/test/urls.js
@@ -2569,8 +2569,57 @@ var urls = [{
         ip4: false,
         ip6: false,
         idn: false,
         punycode: false
       }
+    }, {
+      name: 'leading white space',
+      url: '\t\bhttp://www.example.org/?hello=world',
+      _url: 'http://www.example.org/?hello=world',
+      parts: {
+        protocol: 'http',
+        username: null,
+        password: null,
+        hostname: 'www.example.org',
+        port: null,
+        path: '/',
+        query: 'hello=world',
+        fragment: null
+      },
+      accessors: {
+        protocol: 'http',
+        username: '',
+        password: '',
+        port: '',
+        path: '/',
+        query: 'hello=world',
+        fragment: '',
+        resource: '/?hello=world',
+        authority: 'www.example.org',
+        origin: 'http://www.example.org',
+        userinfo: '',
+        subdomain: 'www',
+        domain: 'example.org',
+        tld: 'org',
+        directory: '/',
+        filename: '',
+        suffix: '',
+        hash: '',
+        search: '?hello=world',
+        host: 'www.example.org',
+        hostname: 'www.example.org'
+      },
+      is: {
+        urn: false,
+        url: true,
+        relative: false,
+        name: true,
+        sld: false,
+        ip: false,
+        ip4: false,
+        ip6: false,
+        idn: false,
+        punycode: false
+      }
     }
 ];
 

Fixed code:   URI.leading_whitespace_expression = /^[\x00-\x20\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]+/

    string = string.replace(URI.leading_whitespace_expression, '')

    }, {
      name: 'leading white space',
      url: '\t\bhttp://www.example.org/?hello=world',
      _url: 'http://www.example.org/?hello=world',
      parts: {
        protocol: 'http',
        username: null,
        password: null,
        hostname: 'www.example.org',
        port: null,
        path: '/',
        query: 'hello=world',
        fragment: null
      },
      accessors: {
        protocol: 'http',
        username: '',
        password: '',
        port: '',
        path: '/',
        query: 'hello=world',
        fragment: '',
        resource: '/?hello=world',
        authority: 'www.example.org',
        origin: 'http://www.example.org',
        userinfo: '',
        subdomain: 'www',
        domain: 'example.org',
        tld: 'org',
        directory: '/',
        filename: '',
        suffix: '',
        hash: '',
        search: '?hello=world',
        host: 'www.example.org',
        hostname: 'www.example.org'
      },
      is: {
        urn: false,
        url: true,
        relative: false,
        name: true,
        sld: false,
        ip: false,
        ip4: false,
        ip6: false,
        idn: false,
        punycode: false
      }