senchalabs/connect — pull request #938 by dougwilson (2013-10-21 03:03:31+00:00)
Title: Fix parsing URL that looks like protocol-relative auth

I had some errors pop up in one of my servers yesterday from `static` due to a weird URL that was requested. A request like `GET //rock@me HTTP/1.1` where the `static` middleware is mounted at the root causes an error, as the pathname of the URL is passed through to `url.parse` which treats URLs that start with `//` and have `blah@blah` next as an absolute URL with auth on purpose. I added a nice work-around where that will detect this and swap the `@` to `%40` (as it should have been, but sadly we cannot control the clients) and re-parse the URL. The changed routine memorizes the parses, which works out fine for performance.

`url.parse` was really meant to parse full URLs, and using it to just parse pathnames is already a hack (even noted in some commits in node itself), which is why this case happens to fail :-/