From d6e6204552622efc5e0af5a99c39cfac7cf7c0cc Mon Sep 17 00:00:00 2001 From: Blake Embrey Date: Thu, 28 Mar 2024 17:18:52 -0700 Subject: [PATCH] deps: encodeurl@~2.0.0 --- History.md | 6 ++++++ lib/response.js | 10 +--------- package.json | 2 +- test/res.location.js | 17 +++-------------- 4 files changed, 11 insertions(+), 24 deletions(-) diff --git a/History.md b/History.md index ac2e7cf719..1aefd4b968 100644 --- a/History.md +++ b/History.md @@ -1,3 +1,9 @@ +unreleased +========== + + * deps: encodeurl@~2.0.0 + - Removes encoding of `\`, `|`, and `^` to align better with URL spec + 4.19.2 / 2024-03-25 ========== diff --git a/lib/response.js b/lib/response.js index dd7b3c8201..29845a7d83 100644 --- a/lib/response.js +++ b/lib/response.js @@ -55,7 +55,6 @@ module.exports = res */ var charsetRegExp = /;\s*charset\s*=/; -var schemaAndHostRegExp = /^(?:[a-zA-Z][a-zA-Z0-9+.-]*:)?\/\/[^\\\/\?]+/; /** * Set status `code`. @@ -914,14 +913,7 @@ res.location = function location(url) { loc = String(url); } - var m = schemaAndHostRegExp.exec(loc); - var pos = m ? m[0].length + 1 : 0; - - // Only encode after host to avoid invalid encoding which can introduce - // vulnerabilities (e.g. `\\` to `%5C`). - loc = loc.slice(0, pos) + encodeUrl(loc.slice(pos)); - - return this.set('Location', loc); + return this.set('Location', encodeUrl(loc)); }; /** diff --git a/package.json b/package.json index f299d882b0..88e4206fe6 100644 --- a/package.json +++ b/package.json @@ -37,7 +37,7 @@ "cookie-signature": "1.0.6", "debug": "2.6.9", "depd": "2.0.0", - "encodeurl": "~1.0.2", + "encodeurl": "~2.0.0", "escape-html": "~1.0.3", "etag": "~1.8.1", "finalhandler": "1.2.0", diff --git a/test/res.location.js b/test/res.location.js index 141ee90131..2e88002625 100644 --- a/test/res.location.js +++ b/test/res.location.js @@ -293,23 +293,12 @@ describe('res', function(){ ); }); - it('should percent encode backslashes in the path', function (done) { + it('should keep backslashes in the path', function (done) { var app = createRedirectServerForDomain('google.com'); testRequestedRedirect( app, 'https://google.com/foo\\bar\\baz', - 'https://google.com/foo%5Cbar%5Cbaz', - 'google.com', - done - ); - }); - - it('should encode backslashes in the path after the first backslash that triggered path parsing', function (done) { - var app = createRedirectServerForDomain('google.com'); - testRequestedRedirect( - app, - 'https://google.com\\@app\\l\\e.com', - 'https://google.com\\@app%5Cl%5Ce.com', + 'https://google.com/foo\\bar\\baz', 'google.com', done ); @@ -364,7 +353,7 @@ describe('res', function(){ testRequestedRedirect( app, 'file:///etc\\passwd', - 'file:///etc%5Cpasswd', + 'file:///etc\\passwd', '', done );