CVE-2022-0868 (JavaScript, published 2022-03-06T16:15Z)
Description: value: Open Redirect in GitHub repository medialize/uri.js prior to 1.19.10.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/medialize/uri.js
Files changed:
src/URI.js
test/urls.js
Commit message: fix(parse): handle excessive colons in scheme delimiter

reported by @huydoppa via huntr.dev


Vulnerable code:
    string = string.replace(/^(https?|ftp|wss?)?:[/\\]*/i, '$1://');

Fixed code:
    string = string.replace(/^(https?|ftp|wss?)?:+[/\\]*/i, '$1://');
    }, {
      name: 'excessive colon in protocol delimiter',
      url: 'http:://www.example.org:8080/hello:world',
      _url: 'http://www.example.org:8080/hello:world',
      parts: {
        protocol: 'http',
        username: null,
        password: null,
        hostname: 'www.example.org',
        port: '8080',
        path: '/hello:world',
        query: null,
        fragment: null
      },
      accessors: {
        protocol: 'http',
        username: '',
        password: '',
        port: '8080',
        path: '/hello:world',
        query: '',
        fragment: '',
        resource: '/hello:world',
        authority: 'www.example.org:8080',
        origin: 'http://www.example.org:8080',
        userinfo: '',
        subdomain: 'www',
        domain: 'example.org',
        tld: 'org',
        directory: '/',
        filename: 'hello:world',
        suffix: '',
        hash: '', // location.hash style
        search: '', // location.search style
        host: 'www.example.org:8080',
        hostname: 'www.example.org'
      },
      is: {
        urn: false,
        url: true,
        relative: false,
        name: true,
        sld: false,
        ip: false,
        ip4: false,
        ip6: false,
        idn: false,
        punycode: false
      }
    }, {
      name: 'excessive colon in protocol delimiter backslashes',
      url: 'http::\\\\www.example.org:8080/hello:world',
      _url: 'http://www.example.org:8080/hello:world',
      parts: {
        protocol: 'http',
        username: null,
        password: null,
        hostname: 'www.example.org',
        port: '8080',
        path: '/hello:world',
        query: null,
        fragment: null
      },
      accessors: {
        protocol: 'http',
        username: '',
        password: '',
        port: '8080',
        path: '/hello:world',
        query: '',
        fragment: '',
        resource: '/hello:world',
        authority: 'www.example.org:8080',
        origin: 'http://www.example.org:8080',
        userinfo: '',
        subdomain: 'www',
        domain: 'example.org',
        tld: 'org',
        directory: '/',
        filename: 'hello:world',
        suffix: '',
        hash: '', // location.hash style
        search: '', // location.search style
        host: 'www.example.org:8080',
        hostname: 'www.example.org'
      },
      is: {
        urn: false,
        url: true,
        relative: false,
        name: true,
        sld: false,
        ip: false,
        ip4: false,
        ip6: false,
        idn: false,
        punycode: false
      }