CVE-2021-27515 (JavaScript, published 2021-02-22T00:15Z)
Description: value: url-parse before 1.5.0 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/unshiftio/url-parse
Files changed:
SECURITY.md
index.js
test/fuzzy.js
test/test.js
Commit message: [security] More backslash fixes (#197)



Vulnerable code:
  - Fixed in: 1.4.5
  , slashes = /^[A-Za-z][A-Za-z0-9+-.]*:\/\//
  , protocolre = /^([a-z][a-z0-9.+-]*:)?(\/\/)?([\S\s]*)/i
  var match = protocolre.exec(address);
    protocol: match[1] ? match[1].toLowerCase() : '',
    slashes: !!match[2],
    assume(parsed.href).equals('http://example.com');
    parsed = parse('//\\what-is-up.com');
    assume(parsed.host).equals('');
    assume(parsed.hostname).equals('');
          href: 'http://example.com',
          pathname: ''
          protocol: 'mailto:'
          protocol: 'data:'
          protocol: 'sip:'
      var data;
        data = parse(testData[i].href);
        assume(data.protocol).equals(testData[i].protocol);
        assume(data.pathname).equals(testData[i].pathname);
      var url = 'http://user:password@[3ffe:2a00:100:7031::1]:8080'
      assume(data.href).equals('http://localhost');
      var data = parse('//foo.com/foo', parse('http://sub.example.com:808/'));
      assume(data.href).equals('http://localhost');
        ['', 'http://foo.com', ''],
      assume(data.href).equals('http://example.com#usage');
      assume(data.href).equals('http://example.com#license');

Fixed code:
> Using backslash in the protocol is valid in the browser, while url-parse
> thinks it’s a relative path. An application that validates a url using
> url-parse might pass a malicious link.

- **Reporter credits**
  - CxSCA AppSec team at Checkmarx.
  - Twitter: [Yaniv Nizry](https://twitter.com/ynizry)
- Fixed in: 1.5.0

- Fixed in: 1.4.5
  , slashes = /^[A-Za-z][A-Za-z0-9+-.]*:[\\/]+/
  , protocolre = /^([a-z][a-z0-9.+-]*:)?([\\/]{1,})?([\S\s]*)/i

  var match = protocolre.exec(address)
    , protocol = match[1] ? match[1].toLowerCase() : ''
    , slashes = !!(match[2] && match[2].length >= 2);
    protocol: protocol,
    slashes: slashes,
  //
  // Default to a / for pathname if none exists. This normalizes the URL
  // to always have a /
  //
  if (url.pathname.charAt(0) !== '/' && url.hostname) {
    url.pathname = '/' + url.pathname;
  }

  spec.slashes = true;
  
    assume(parsed.pathname).equals('/');
    assume(parsed.href).equals('http://example.com/');
    parsed = parse('http://yolo.com\\what-is-up.com');
    assume(parsed.host).equals('what-is-up.com');
    assume(parsed.href).equals('//what-is-up.com/');
  });

  it('does not see a slash after the protocol as path', function () {
    var url = 'https:\\/github.com/foo/bar'
      , parsed = parse(url);

    assume(parsed.host).equals('github.com');
    assume(parsed.hostname).equals('github.com');
    assume(parsed.pathname).equals('/foo/bar');

    url = 'https:/\/\/\github.com/foo/bar';
    assume(parsed.host).equals('github.com');
    assume(parsed.hostname).equals('github.com');
    assume(parsed.pathname).equals('/foo/bar');
          href: 'http://example.com/',
          pathname: '/',
          slashes: true
        },
        {
          href: 'ws://example.com/',
          protocol: 'ws:',
          pathname: '/',
          slashes: true
        },
        {
          href: 'wss://example.com/',
          protocol: 'wss:',
          pathname: '/',
          slashes: true
          protocol: 'mailto:',
          slashes: false
          protocol: 'data:',
          slashes: false,
          protocol: 'sip:',
          slashes: false,
      var data, test;
        test = testData[i];
        data = parse(test.href);

        assume(data.protocol).equals(test.protocol);
        assume(data.pathname).equals(test.pathname);
        assume(data.slashes).equals(test.slashes);
        assume(data.href).equals(test.href);
      var url = 'http://user:password@[3ffe:2a00:100:7031::1]:8080/'
      assume(parsed.pathname).equals('/');
      assume(data.href).equals('http://localhost/');
      var lolcation = parse('http://sub.example.com:808/')
        , data = parse('//foo.com/foo', lolcation);
      assume(data.href).equals('http://localhost/');
        ['', 'http://foo.com', '/'],
      assume(data.href).equals('http://example.com/#usage');
      assume(data.href).equals('http://example.com/#license');