CVE-2022-1233 (JavaScript, published 2022-04-04T20:15Z)
Description: value: URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/medialize/uri.js
Files changed:
CHANGELOG.md
src/URI.js
test/urls.js
Commit message: fix(parse): handle excessive slashes in scheme-relative URLs

reported by @zeyu2001 via huntr.dev


Vulnerable code:

Fixed code:
### master ###

* **SECURITY** fixing [`URI.parse()`](http://medialize.github.io/URI.js/docs.html#static-parse) handle excessive slashes in scheme-relative URLs - disclosed by [zeyu2001](https://github.com/zeyu2001) via https://huntr.dev/

    // slashes and backslashes have lost all meaning for scheme relative URLs
    string = string.replace(/^[/\\]{2,}/i, '//');
  }, {
    name: 'ignoring scheme excessive slashes',
    url: ':/\\//user:pass@example.org:123/some/directory/file.html?query=string#fragment',
    _url: '//user:pass@example.org:123/some/directory/file.html?query=string#fragment',
    parts: {
      protocol: null,
      username: 'user',
      password: 'pass',
      hostname: 'example.org',
      port: '123',
      path: '/some/directory/file.html',
      query: 'query=string',
      fragment: 'fragment'
    },
    accessors: {
      protocol: '',
      username: 'user',
      password: 'pass',
      port: '123',
      path: '/some/directory/file.html',
      query: 'query=string',
      fragment: 'fragment',
      resource: '/some/directory/file.html?query=string#fragment',
      authority: 'user:pass@example.org:123',
      origin: 'user:pass@example.org:123',
      userinfo: 'user:pass',
      subdomain: '',
      domain: 'example.org',
      tld: 'org',
      directory: '/some/directory',
      filename: 'file.html',
      suffix: 'html',
      hash: '#fragment',
      search: '?query=string',
      host: 'example.org:123',
      hostname: 'example.org'
    },
    is: {
      urn: false,
      url: true,
      relative: false,
      name: true,
      sld: false,
      ip: false,
      ip4: false,
      ip6: false,
      idn: false,
      punycode: false
    }
  }, {
    name: 'scheme-relative URL excessive slashes',
    url: '//\\/www.example.org/',
    _url: '//www.example.org/',
    parts: {
      protocol: null,
      username: null,
      password: null,
      hostname: 'www.example.org',
      port: null,
      path: '/',
      query: null,
      fragment: null
    },
    accessors: {
      protocol: '',
      username: '',
      password: '',
      port: '',
      path: '/',
      query: '',
      fragment: '',
      resource: '/',
      authority: 'www.example.org',
      origin: 'www.example.org',
      userinfo: '',
      subdomain: 'www',
      domain: 'example.org',
      tld: 'org',
      directory: '/',
      filename: '',
      suffix: '',
      hash: '',
      search: '',
      host: 'www.example.org',
      hostname: 'www.example.org'
    },
    is: {
      urn: false,
      url: true,
      relative: false,
      name: true,
      sld: false,
      ip: false,
      ip4: false,
      ip6: false,
      idn: false,
      punycode: false
    }