Kikobeats / parse-proxy-uri / 31181760862

100%

push

github

fix: keep ProxyURL credential mutations decode-safe (#27)

* fix: keep ProxyURL credential mutations decode-safe

Node's URL userinfo setters leave bare `%` sequences intact, so assigning
a password like `100%pure` via `.password` or `.href` made `.auth` throw
URIError and `toString()` emit a URI that got-scraping cannot decode.

Encode invalid `%` on username/password assignment, and reject href
mutations that introduce undecodable or control-character credentials
while rolling back to the previous value.

Co-authored-by: kikohumanbeatbox <kikohumanbeatbox@gmail.com>

* fix: validate every ProxyURL mutation path

The constructor's invariants only ran at parse time, so any setter could walk
a parsed proxy back into a shape parseProxy would have rejected: `href` took
paths, queries, fragments, `data:` URIs and obfuscated IPv4 hosts; `hostname`
and `host` re-opened the IPv4 rewrite closed in #25; `pathname`/`search`/`hash`
and `searchParams` desynced `href` from `toString()`.

Every mutation now runs the full check and rolls back on rejection, and
failures throw ParseProxyError (now a TypeError) so `error.code` works the
same as it does for parseProxy.

Credential setters take raw values and encode them, replacing the hybrid rule
where a password containing `%40` was silently decoded to `@` and dialed
wrong. `username`, `password` and `href` are non-enumerable, matching
URL.prototype, so spreading or logging a proxy no longer leaks credentials.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PUCXKwRQmtkcisF71E4MRj

* refactor: move ProxyURL accessors to the prototype

The guards were built per instance: 11 defineProperty calls and 13 closures
over the constructor scope for every parsed proxy, so each live proxy pinned
that scope. Defining them once on the prototype cuts parse from 2295 to 682
ns/op and 3351 to 262 bytes per live instance (200k iterations, 50k live
instances, --expose-g... (continued)

62 of 62 branches covered (100.0%)

Branch coverage included in aggregate %.

133 of 133 new or added lines in 1 file covered. (100.0%)

182 of 182 relevant lines covered (100.0%)

55.23 hits per line