CVE-2022-2216 (JavaScript, published 2022-06-27T12:15Z)
Description: value: Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 7.0.0.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/ionicabizau/parse-url
Files changed:
lib/index.js
package.json
test/index.js
Commit message: Refactor codebase, upgrade dependencies


Vulnerable code:
 * @param {Boolean|Object} normalize Wheter to normalize the url or not.
 *  - `protocols` (Array): An array with the url protocols (usually it has one element).
 *  - `protocol` (String): The first protocol, `"ssh"` (if the url is a ssh url) or `"file"`.
 *  - `port` (null|Number): The domain port.
 *  - `resource` (String): The url domain (including subdomains).
 *  - `user` (String): The authentication user (usually for ssh urls).
 *  - `pathname` (String): The url pathname.
 *  - `hash` (String): The url hash.
 *  - `search` (String): The url querystring value.
 *  - `href` (String): The input url.
 *  - `query` (Object): The url querystring, parsed as object.
function parseUrl(url, normalize = false) {
    "is-ssh": "^1.3.0",
    "parse-path": "^4.0.4",
    "protocols": "^1.4.0"
}
    , qs = require("querystring")
          , port: null
          , port: null
          , port: null
          , port: null
            protocols: []
          , port: null
          , port: null
            c[1].query = qs.parse(c[1].search)
            c[1].href = url

Fixed code:
// Dependencies

 * @param {Boolean|Object} normalize Whether to normalize the url or not.
 *    - `protocols` (Array): An array with the url protocols (usually it has one element).
 *    - `protocol` (String): The first protocol, `"ssh"` (if the url is a ssh url) or `"file"`.
 *    - `port` (null|Number): The domain port.
 *    - `resource` (String): The url domain (including subdomains).
 *    - `user` (String): The authentication user (usually for ssh urls).
 *    - `pathname` (String): The url pathname.
 *    - `hash` (String): The url hash.
 *    - `search` (String): The url querystring value.
 *    - `href` (String): The input url.
 *    - `query` (Object): The url querystring, parsed as object.
const parseUrl = (url, normalize = false) => {

    // Constants
    const GIT_RE = /((git@|http(s)?:\/\/)([\w\.@]+)(\/|:))(([\~,\w,\-,\_,\/]+)(.git){0,1}((\/){0,1}))/




    // Potential git-ssh urls
    if (parsed.protocol === "file") {
        const matched  = parsed.href.match(GIT_RE)
        if (matched) {
            parsed.protocols = ["ssh"]
            parsed.protocol = "ssh"
            parsed.resource = matched[4]
            parsed.user = "git"
            parsed.pathname = `/${matched[6]}`
        }
    }

    "is-ssh": "^1.4.0",
    "parse-path": "^5.0.0",
    "protocols": "^2.0.1"
}
          , port: ""
          , query: {}
          , port: ""
          , query: {}
          , port: ""
          , query: {}
          , port: ""
          , query: {}
            protocols: ["ssh"]
          , port: ""
          , query: {}
          , port: ""
          , query: {}


            c[1].href = c[1].href || url
            c[1].password = c[1].password || ""