Kikobeats / url-http / 31020158231

100%

main: 100%

push

github

fix: reject credentialed URLs for IPv6, punycode, and text fragments (#30)

* fix: reject credentialed URLs for IPv6, punycode, and text fragments

url-regex-safe can match a substring after `@` when exact matching is
disabled, so userinfo-bearing URLs were accepted even though the common
exact-match path rejects them. Reject username/password up front.

* refactor: fold the credential guard into the protocol check

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MTbj6CYXGsk6rhXx7J8SUP

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Kiko Beats <josefrancisco.verdu@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

17 of 17 branches covered (100.0%)

Branch coverage included in aggregate %.

2 of 2 new or added lines in 1 file covered. (100.0%)

37 of 37 relevant lines covered (100.0%)

18.3 hits per line