Kikobeats / parse-proxy-uri

97%

push

github

fix: reject embedded tabs and newlines in proxy URIs (#36)

* fix: reject embedded tabs and newlines in proxy URIs

WHATWG strips ASCII tab and newlines before parsing, so they bypass the
credential and host checks. An embedded newline can move the proxy host
and send credentials to a different server.

* fix: reject host code points the URL parser drops

Host parsing deletes marks such as U+FEFF and U+200B, so a proxy written
as trusted.evil.com is stored as the joined name and the credentials follow.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix: keep opaque hosts whose percent bytes are not UTF-8

decodeURIComponent throws on those bytes, but a SOCKS host keeps them.
The ignored-mark scan only runs after a successful decode.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Kiko Beats <josefrancisco.verdu@gmail.com>

139 of 153 branches covered (90.85%)

Branch coverage included in aggregate %.

52 of 52 new or added lines in 1 file covered. (100.0%)

346 of 348 relevant lines covered (99.43%)

150.74 hits per line