Kikobeats / url-http

100%

main: 100%

push

github

fix: validate the authority instead of the whole href (#34)

`new URL()` already applies IDNA, IPv4/IPv6 validation and percent-encoding,
so the only question left is whether the host is one the public internet can
resolve. Answering that directly replaces the round-trip through
url-regex-safe, a matcher built to find URLs inside prose.

Closes the fake-IDN-TLD hole: url-regex-safe's list holds no `xn--` entries,
so #32 had to inject the host's own TLD, which is a check that passes by
construction. `https://xn--80a0aaa.xn--totallyfaketld/` was accepted and the
design could not reject it. Mapping the list to punycode once at load makes
the punycode case fall out instead of needing a special case, so the IPv6
exception, the TLD injection and the second origin-only pass all go away
along with the url-regex-safe and re2 dependencies.

Fuzz-differentialled against the previous implementation over 300k inputs.
Every divergence falls in one of four classes:

- paths ending in prose punctuation (`/a.`, `/?q=1.`, `/#x!`) are now
  accepted; url-regex-safe forbids a trailing `. ? !` because in prose it is
  sentence punctuation
- ports below 10 (`http://example.com:1/`) are now accepted
- an underscore is now allowed in any interior label, not only in a bare
  second-level one (`x.a_b.com` was rejected while `a_b.com` was accepted)
- a host whose TLD is not in the public suffix list is now rejected in
  punycode form too

Per call: 21.6us to 0.29us on ordinary hosts, 3.8us to 0.34us on punycode.


Claude-Session: https://claude.ai/code/session_01G3AcnZdy222rWCkptbywJT

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

24 of 24 branches covered (100.0%)

Branch coverage included in aggregate %.

25 of 25 new or added lines in 1 file covered. (100.0%)

46 of 46 relevant lines covered (100.0%)

22.33 hits per line