Kikobeats / parse-proxy-uri / 30890397619

100%

push

github

fix: harden proxy URI parsing (#25)

* fix: harden proxy URI parsing

Reject WHATWG misparses that silent-misroute traffic (schemeless
host:port, rewritten IPv4, path/query/hash userinfo), keep
credentials live across href/host mutation, and leave auth empty
when credentials are omitted.

Supersedes #22, #23, #24.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix: reject malformed credential escapes at parse

Eager-decode userinfo in the constructor so INVALID_PROXY still
fires instead of a late URIError from the live getters.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix: accept encoded IPv4 and String proxies

Percent-decode the raw host before the IPv4 rewrite check, and
coerce inputs with String() so boxed String URIs keep working.

Co-authored-by: Cursor <cursoragent@cursor.com>

* refactor: slim proxy URI hardening

Drop restating comments, dead IPv6 host parsing, and duplicated
invalid-proxy test boilerplate.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

37 of 39 branches covered (94.87%)

Branch coverage included in aggregate %.

62 of 62 new or added lines in 1 file covered. (100.0%)

125 of 125 relevant lines covered (100.0%)

16.58 hits per line