url: drop auth in url.resolve() if host changes

rlidwka · jasnell · commit 1b50b80e06db · 2016-04-26T12:16:39.000-07:00
Fixes: #1435 PR-URL: #1480 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Brian White <mscdex@mscdex.net>
diff --git a/lib/url.js b/lib/url.js
@@ -754,6 +754,7 @@ Url.prototype.resolveObject = function(relative) {
     if (relative.protocol) {
       relative.hostname = null;
       relative.port = null;
+      result.auth = null;
       if (relative.host) {
         if (relPath[0] === '') relPath[0] = relative.host;
         else relPath.unshift(relative.host);
@@ -765,10 +766,14 @@ Url.prototype.resolveObject = function(relative) {
 
   if (isRelAbs) {
     // it's absolute.
-    result.host = (relative.host || relative.host === '') ?
-                  relative.host : result.host;
-    result.hostname = (relative.hostname || relative.hostname === '') ?
-                      relative.hostname : result.hostname;
+    if (relative.host || relative.host === '') {
+      result.host = relative.host;
+      result.auth = null;
+    }
+    if (relative.hostname || relative.hostname === '') {
+      result.hostname = relative.hostname;
+      result.auth = null;
+    }
     result.search = relative.search;
     result.query = relative.query;
     srcPath = relPath;
diff --git a/test/parallel/test-url.js b/test/parallel/test-url.js
@@ -1538,7 +1538,21 @@ var relativeTests2 = [
   //changeing auth
   ['http://diff:auth@www.example.com',
    'http://asdf:qwer@www.example.com',
-   'http://diff:auth@www.example.com/']
+   'http://diff:auth@www.example.com/'],
+
+  // https://github.com/nodejs/node/issues/1435
+  ['https://another.host.com/',
+   'https://user:password@example.org/',
+   'https://another.host.com/'],
+  ['//another.host.com/',
+   'https://user:password@example.org/',
+   'https://another.host.com/'],
+  ['http://another.host.com/',
+   'https://user:password@example.org/',
+   'http://another.host.com/'],
+  ['mailto:another.host.com',
+   'mailto:user@example.org',
+   'mailto:another.host.com'],
 ];
 relativeTests2.forEach(function(relativeTest) {
   const a = url.resolve(relativeTest[1], relativeTest[0]);
