CVE-2022-1243: Other (NVD-CWE-Other)
value: CRHTLF can lead to invalid protocol extraction potentially leading to XSS in GitHub repository medialize/uri.js prior to 1.19.11.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 6.1
Published: 2022-04-05T15:15Z
Repository: https://github.com/medialize/uri.js
Language: JavaScript
Files changed: CHANGELOG.md, src/URI.js, test/urls.js
Commit date: 2022-04-03 11:24:54 +0200
Commit message: fix(parse): handle CR,LF,TAB

reported by @haxatron via huntr.dev

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index d576563..32057b1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,10 +3,11 @@
 The release notes tracked in this document are also made available on the [releases page](https://github.com/medialize/URI.js/releases)
 
 ### master ###
 
 * **SECURITY** fixing [`URI.parse()`](http://medialize.github.io/URI.js/docs.html#static-parse) handle excessive slashes in scheme-relative URLs - disclosed by [zeyu2001](https://github.com/zeyu2001) via https://huntr.dev/
+* **SECURITY** fixing [`URI.parse()`](http://medialize.github.io/URI.js/docs.html#static-parse) remove `\r` (CR), `\n`, (LF) `\t` (TAB) - disclosed by [haxatron](https://github.com/haxatron) via https://huntr.dev/
 
 ### 1.19.10 (March 5th 2022) ###
 
 * **SECURITY** fixing [`URI.parse()`](http://medialize.github.io/URI.js/docs.html#static-parse) handle excessive colons in protocol delimiter - disclosed by [huydoppa](https://github.com/huydoppa) via https://huntr.dev/
 
diff --git a/src/URI.js b/src/URI.js
index c46352b..330a480 100644
--- a/src/URI.js
+++ b/src/URI.js
@@ -238,10 +238,12 @@
     trim: /[`!()\[\]{};:'".,<>?«»“”„‘’]+$/,
     // balanced parens inclusion (), [], {}, <>
     parens: /(\([^\)]*\)|\[[^\]]*\]|\{[^}]*\}|<[^>]*>)/g,
   };
   URI.leading_whitespace_expression = /^[\x00-\x20\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]+/
+  // https://infra.spec.whatwg.org/#ascii-tab-or-newline
+  URI.ascii_tab_whitespace = /[\u0009\u000A\u000D]+/g
   // http://www.iana.org/assignments/uri-schemes.html
   // http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers#Well-known_ports
   URI.defaultPorts = {
     http: '80',
     https: '443',
@@ -495,10 +497,12 @@
         preventInvalidHostname: URI.preventInvalidHostname
       };
     }
 
     string = string.replace(URI.leading_whitespace_expression, '')
+    // https://infra.spec.whatwg.org/#ascii-tab-or-newline
+    string = string.replace(URI.ascii_tab_whitespace, '')
 
     // [protocol"://"[username[":"password]"@"]hostname[":"port]"/"?][path]["?"querystring]["#"fragment]
 
     // extract fragment
     pos = string.indexOf('#');
diff --git a/test/urls.js b/test/urls.js
index d8c32ef..0dd0e84 100644
--- a/test/urls.js
+++ b/test/urls.js
@@ -2716,10 +2716,59 @@ var urls = [{
         ip4: false,
         ip6: false,
         idn: false,
         punycode: false
       }
+    }, {
+      name: 'ASCII tab or newline',
+      url: 'ja\r\nva\tscript:alert(1)',
+      _url: 'javascript:alert(1)',
+      parts: {
+        protocol: 'javascript',
+        username: null,
+        password: null,
+        hostname: null,
+        port: null,
+        path: 'alert(1)',
+        query: null,
+        fragment: null
+      },
+      accessors: {
+        protocol: 'javascript',
+        username: '',
+        password: '',
+        port: '',
+        path: 'alert(1)',
+        query: '',
+        fragment: '',
+        resource: 'alert(1)',
+        authority: '',
+        origin: '',
+        userinfo: '',
+        subdomain: '',
+        domain: '',
+        tld: '',
+        directory: '',
+        filename: '',
+        suffix: '',
+        hash: '',
+        search: '',
+        host: '',
+        hostname: ''
+      },
+      is: {
+        urn: true,
+        url: false,
+        relative: false,
+        name: false,
+        sld: false,
+        ip: false,
+        ip4: false,
+        ip6: false,
+        idn: false,
+        punycode: false
+      }
     }, {
       name: 'excessive colon in protocol delimiter',
       url: 'http:://www.example.org:8080/hello:world',
       _url: 'http://www.example.org:8080/hello:world',
       parts: {

Fixed code: * **SECURITY** fixing [`URI.parse()`](http://medialize.github.io/URI.js/docs.html#static-parse) remove `\r` (CR), `\n`, (LF) `\t` (TAB) - disclosed by [haxatron](https://github.com/haxatron) via https://huntr.dev/
  // https://infra.spec.whatwg.org/#ascii-tab-or-newline
  URI.ascii_tab_whitespace = /[\u0009\u000A\u000D]+/g
    // https://infra.spec.whatwg.org/#ascii-tab-or-newline
    string = string.replace(URI.ascii_tab_whitespace, '')
    }, {
      name: 'ASCII tab or newline',
      url: 'ja\r\nva\tscript:alert(1)',
      _url: 'javascript:alert(1)',
      parts: {
        protocol: 'javascript',
        username: null,
        password: null,
        hostname: null,
        port: null,
        path: 'alert(1)',
        query: null,
        fragment: null
      },
      accessors: {
        protocol: 'javascript',
        username: '',
        password: '',
        port: '',
        path: 'alert(1)',
        query: '',
        fragment: '',
        resource: 'alert(1)',
        authority: '',
        origin: '',
        userinfo: '',
        subdomain: '',
        domain: '',
        tld: '',
        directory: '',
        filename: '',
        suffix: '',
        hash: '',
        search: '',
        host: '',
        hostname: ''
      },
      is: {
        urn: true,
        url: false,
        relative: false,
        name: false,
        sld: false,
        ip: false,
        ip4: false,
        ip6: false,
        idn: false,
        punycode: false
      }