You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Apr 22, 2023. It is now read-only.
url.parse misinterpreted https://good.com+.evil.org/ as https://good.com/+.evil.org/
If we use url.parse to check the validity of the hostname, the test passes, but in the browser the user is redirected to the evil.org website.
Node v0.10.32
returns
url.parsemisinterpretedhttps://good.com+.evil.org/ashttps://good.com/+.evil.org/If we use
url.parseto check the validity of the hostname, the test passes, but in the browser the user is redirected to theevil.orgwebsite.Other characters than
+might do the trick too.