src: forbid lt and gt in url host code point #33328

yashLadha · 2020-05-09T16:23:31Z

As per the recent changes in whatwg/url spec. lt and gt are also added
in the list of forbidden hostCodePoint list.

Ref: whatwg/url#459
Ref: #33315

Checklist

make -j4 test (UNIX), or vcbuild test (Windows) passes
tests and/or benchmarks are included
documentation is changed or added
commit message follows commit guidelines

addaleax · 2020-05-09T17:01:07Z

The commit message should probably start with url:
Is this semver-major? (My guess: technically yes but practically speaking it’s okay?)
Should this be backported to other release lines?
Should we wait for the upstream PR to be merged first?

Trott · 2020-05-10T04:55:49Z

Should we wait for the upstream PR to be merged first?

I'm inclined to say "yes" and so I'm adding a blocked label, but if I'm the only person who feels that way, by all means, remove it.

Accidental...

jasnell · 2020-05-11T14:36:08Z

This is going to need tests. I see that the upstream PR is also waiting on tests so this might need to sit until the corresponding WPT tests are in place.

Technically I do think this is semver major but I think we need to discuss and determine a policy for breaking changes in specs as this is technically a breaking change at the whatwg url level.

addaleax · 2020-05-19T22:11:29Z

Ping @yashLadha, the upstream PR has been merged so I think this can move forward?

yashLadha · 2020-05-20T03:15:53Z

Sure, will pick this today again @addaleax 👍

yashLadha · 2020-05-20T16:42:54Z

@addaleax updated PR with tests

cc: @jasnell

nodejs-github-bot · 2020-05-20T16:49:32Z

CI: https://ci.nodejs.org/job/node-test-pull-request/31452/

ZYSzys · 2020-05-21T14:18:42Z

src/node_url.cc

@@ -206,7 +206,7 @@ CHAR_TEST(8, IsForbiddenHostCodePoint,
          ch == '\0' || ch == '\t' || ch == '\n' || ch == '\r' ||
          ch == ' ' || ch == '#' || ch == '%' || ch == '/' ||
          ch == ':' || ch == '?' || ch == '@' || ch == '[' ||
-          ch == '\\' || ch == ']')
+          ch == '<' || ch == '>' || ch == '\\' || ch == ']')


We should include ^ too.

Yes working on it.

As per the recent changes in whatwg/url spec. lt and gt are also added in the list of forbidden hostCodePoint list. Ref: whatwg/url#459 Ref: nodejs#33315

nodejs-github-bot · 2020-05-22T01:47:21Z

CI: https://ci.nodejs.org/job/node-test-pull-request/31466/

nodejs-github-bot · 2020-05-23T17:23:10Z

CI: https://ci.nodejs.org/job/node-test-pull-request/31510/ 💚

As per the recent changes in whatwg/url spec. lt and gt are also added in the list of forbidden hostCodePoint list. PR-URL: nodejs#33328 Refs: whatwg/url#459 Refs: nodejs#33315 Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Yongsheng Zhang <[email protected]> Reviewed-By: Ruben Bridgewater <[email protected]>

BridgeAR · 2020-05-23T19:37:34Z

Landed in 9be51ee 🎉

Notable changes: Deprecations and Removals: - **build**: remove --build-v8-with-gn configure option (Yang Guo) (#27576) - **build**: drop support for VS2017 (Michaël Zasso) (#33694) - **doc**: move DEP0018 to End-of-Life (Rich Trott) (#35316) - **fs**: deprecation warning on recursive rmdir (Ian Sutherland) (#35562) - **lib**: add EventTarget-related browser globals (Anna Henningsen) (#35496) - **net**: remove long deprecated server.connections property (James M Snell) (#33647) - **repl**: remove deprecated repl.memory function (Ruben Bridgewater) (#33286) - **repl**: remove deprecated repl.turnOffEditorMode() function (Ruben Bridgewater) (#33286) - **repl**: remove deprecated repl.parseREPLKeyword() function (Ruben Bridgewater) (#33286) - **repl**: remove deprecated bufferedCommand property (Ruben Bridgewater) (#33286) - **repl**: remove deprecated .rli (Ruben Bridgewater) (#33286) - **src**: remove deprecated node debug command (James M Snell) (#33648) - **timers**: introduce timers/promises (James M Snell) (#33950) - **util**: change default value of `maxStringLength` to 10000 (unknown) (#32744) - **wasi**: drop --experimental-wasm-bigint requirement (Colin Ihrig) (#35415) npm 7 (#35631): Node.js 15 comes with a new major release of npm, npm 7. npm 7 comes with many new features - including npm workspaces and a new package-lock.json format. npm 7 also includes yarn.lock file support. One of the big changes in npm 7 is that peer dependencies are now installed by default. Throw On Unhandled Rejections (#33021): As of Node.js 15, the default mode for `unhandledRejection` is changed to `throw` (from `warn`). In `throw` mode, if an `unhandledRejection` hook is not set, the `unhandledRejection` is raised as an uncaught exception. Users that have an `unhandledRejection` hook should see no change in behavior, and it’s still possible to switch modes using the `--unhandled-rejections=mode` process flag. QUIC (#32379): Node.js 15 comes with experimental support QUIC, which can be enabled by compiling Node.js with the `--experimental-quic` configuration flag. The Node.js QUIC implementation is exposed by the core `net` module. V8 8.6 (#35415): The V8 JavaScript engine has been updated to V8 8.6 (V8 8.4 is the latest available in Node.js 14). Along with performance tweaks and improvements the V8 update also brings the following language features: * `Promise.any()` (from V8 8.5) * `AggregateError` (from V8 8.5) * `String.prototype.replaceAll()` (from V8 8.5) * Logical assignment operators `&&=`, `||=`, and `??=` (from V8 8.5) Other Notable Changes: - **assert**: add `assert/strict` alias module (ExE Boss) (#34001) - **dns**: add dns/promises alias (shisama) (#32953) - **fs**: reimplement read and write streams using stream.construct (Robert Nagy) (#29656) - **http2**: allow Host in HTTP/2 requests (Alba Mendez) (#34664) - **lib**: add EventTarget-related browser globals (Anna Henningsen) (#35496) - **lib**: unflag AbortController (James M Snell) (#33527) - **lib**: initial experimental AbortController implementation (James M Snell) (#33527) - **net**: autoDestroy Socket (Robert Nagy) (#31806) - **src**: disallow JS execution inside FreeEnvironment (Anna Henningsen) (#33874) - **stream**: construct (Robert Nagy) (#29656) - **worker**: make MessageEvent class more Web-compatible (Anna Henningsen) (#35496) Semver-Major Commits: - **assert**: add `assert/strict` alias module (ExE Boss) (#34001) - **build**: reset embedder string to "-node.0" (Michaël Zasso) (#35415) - **build**: remove --build-v8-with-gn configure option (Yang Guo) (#27576) - **build**: drop support for VS2017 (Michaël Zasso) (#33694) - **crypto**: refactoring internals, add WebCrypto (James M Snell) (#35093) - **crypto**: move node\_crypto files to src/crypto (James M Snell) (#35093) - **deps**: V8: cherry-pick d76abfed3512 (Michaël Zasso) (#35415) - **deps**: V8: cherry-pick 717543bbf0ef (Michaël Zasso) (#35415) - **deps**: V8: cherry-pick 6be2f6e26e8d (Michaël Zasso) (#35415) - **deps**: fix V8 build issue with inline methods (Jiawen Geng) (#35415) - **deps**: fix platform-embedded-file-writer-win for ARM64 (Michaël Zasso) (#35415) - **deps**: update V8 postmortem metadata script (Colin Ihrig) (#35415) - **deps**: update V8 to 8.6.395 (Michaël Zasso) (#35415) - **deps**: upgrade npm to 7.0.0 (Myles Borins) (#35631) - **deps**: update npm to 7.0.0-rc.3 (Myles Borins) (#35474) - **deps**: V8: cherry-pick 0d6debcc5f08 (Gus Caplan) (#33600) - **dns**: add dns/promises alias (shisama) (#32953) - **doc**: move DEP0018 to End-of-Life (Rich Trott) (#35316) - **doc**: update support macos version for 15.x (Ash Cripps) (#35022) - **fs**: deprecation warning on recursive rmdir (Ian Sutherland) (#35562) - **fs**: reimplement read and write streams using stream.construct (Robert Nagy) (#29656) - **http**: fixed socket.setEncoding fatal error (iskore) (#33405) - **http**: emit 'error' on aborted server request (Robert Nagy) (#33172) - **http**: cleanup end argument handling (Robert Nagy) (#31818) - **http2**: allow Host in HTTP/2 requests (Alba Mendez) (#34664) - **http2**: add `invalidheaders` test (Pranshu Srivastava) (#33161) - **http2**: refactor state code validation for the http2Stream class (rickyes) (#33535) - **http2**: header field valid checks (Pranshu Srivastava) (#33193) - **lib**: add EventTarget-related browser globals (Anna Henningsen) (#35496) - **lib**: remove ERR\_INVALID\_OPT\_VALUE and ERR\_INVALID\_OPT\_VALUE\_ENCODING (Denys Otrishko) (#34682) - **lib**: handle one of args case in ERR\_MISSING\_ARGS (Denys Otrishko) (#34022) - **lib**: remove NodeError from the prototype of errors with code (Michaël Zasso) (#33857) - **lib**: unflag AbortController (James M Snell) (#33527) - **lib**: initial experimental AbortController implementation (James M Snell) (#33527) - **net**: check args in net.connect() and socket.connect() calls (Denys Otrishko) (#34022) - **net**: remove long deprecated server.connections property (James M Snell) (#33647) - **net**: autoDestroy Socket (Robert Nagy) (#31806) - **process**: update v8 fast api calls usage (Maya Lekova) (#35415) - **process**: change default --unhandled-rejections=throw (Dan Fabulich) (#33021) - **process**: use v8 fast api calls for hrtime (Gus Caplan) (#33600) - **process**: delay throwing an error using `throwDeprecation` (Ruben Bridgewater) (#32312) - **repl**: remove deprecated repl.memory function (Ruben Bridgewater) (#33286) - **repl**: remove deprecated repl.turnOffEditorMode() function (Ruben Bridgewater) (#33286) - **repl**: remove deprecated repl.parseREPLKeyword() function (Ruben Bridgewater) (#33286) - **repl**: remove deprecated bufferedCommand property (Ruben Bridgewater) (#33286) - **repl**: remove deprecated .rli (Ruben Bridgewater) (#33286) - **src**: implement NodePlatform::PostJob (Clemens Backes) (#35415) - **src**: update NODE\_MODULE\_VERSION to 88 (Michaël Zasso) (#35415) - **src**: error reporting on CPUUsage (Yash Ladha) (#34762) - **src**: use node:moduleName as builtin module filename (Michaël Zasso) (#35498) - **src**: enable wasm trap handler on windows (Gus Caplan) (#35033) - **src**: update NODE\_MODULE\_VERSION to 86 (Michaël Zasso) (#33579) - **src**: disallow JS execution inside FreeEnvironment (Anna Henningsen) (#33874) - **src**: remove \_third\_party\_main support (Anna Henningsen) (#33971) - **src**: remove deprecated node debug command (James M Snell) (#33648) - **src**: remove unused CancelPendingDelayedTasks (Anna Henningsen) (#32859) - **stream**: try to wait for flush to complete before 'finish' (Robert Nagy) (#34314) - **stream**: cleanup and fix Readable.wrap (Robert Nagy) (#34204) - **stream**: add promises version to utility functions (rickyes) (#33991) - **stream**: fix writable.end callback behavior (Robert Nagy) (#34101) - **stream**: construct (Robert Nagy) (#29656) - **stream**: write should throw on unknown encoding (Robert Nagy) (#33075) - **stream**: fix \_final and 'prefinish' timing (Robert Nagy) (#32780) - **stream**: simplify Transform stream implementation (Robert Nagy) (#32763) - **stream**: use callback to properly propagate error (Robert Nagy) (#29179) - **test**: update tests after increasing typed array size to 4GB (Kim-Anh Tran) (#35415) - **test**: fix tests for npm 7.0.0 (Myles Borins) (#35631) - **test**: fix test suite to work with npm 7 (Myles Borins) (#35474) - **test**: update WPT harness and tests (Michaël Zasso) (#33770) - **timers**: introduce timers/promises (James M Snell) (#33950) - **tools**: disable x86 safe exception handlers in V8 (Michaël Zasso) (#35415) - **tools**: update V8 gypfiles for 8.6 (Ujjwal Sharma) (#35415) - **tools**: update V8 gypfiles for 8.5 (Ujjwal Sharma) (#35415) - **url**: file URL path normalization (Daijiro Wachi) (#35477) - **url**: verify domain is not empty after "ToASCII" (Michaël Zasso) (#33770) - **url**: remove U+0000 case in the fragment state (Michaël Zasso) (#33770) - **url**: remove gopher from special schemes (Michaël Zasso) (#33325) - **url**: forbid lt and gt in url host code point (Yash Ladha) (#33328) - **util**: change default value of `maxStringLength` to 10000 (unknown) (#32744) - **wasi**: drop --experimental-wasm-bigint requirement (Colin Ihrig) (#35415) - **win, child_process**: sanitize env variables (Bartosz Sosnowski) (#35210) - **worker**: make MessageEvent class more Web-compatible (Anna Henningsen) (#35496) - **worker**: set trackUnmanagedFds to true by default (Anna Henningsen) (#34394) - **worker**: rename error code to be more accurate (Anna Henningsen) (#33872) PR-URL: #35014

nodejs-github-bot added the c++ Issues and PRs that require attention from people who are familiar with C++. label May 9, 2020

yashLadha force-pushed the forbid_lt_and_gt_hosts branch from f2a0bdd to 8375ea7 Compare May 9, 2020 17:03

Trott added the blocked PRs that are blocked by other issues or PRs. label May 10, 2020

jasnell previously approved these changes May 11, 2020

View reviewed changes

yashLadha force-pushed the forbid_lt_and_gt_hosts branch from 8375ea7 to 165ac13 Compare May 20, 2020 16:42

addaleax approved these changes May 20, 2020

View reviewed changes

yashLadha requested a review from jasnell May 20, 2020 17:41

ZYSzys reviewed May 21, 2020

View reviewed changes

url: forbid lt and gt in url host code point

5b9dac3

As per the recent changes in whatwg/url spec. lt and gt are also added in the list of forbidden hostCodePoint list. Ref: whatwg/url#459 Ref: nodejs#33315

yashLadha force-pushed the forbid_lt_and_gt_hosts branch from 165ac13 to 5b9dac3 Compare May 21, 2020 16:50

yashLadha requested a review from ZYSzys May 21, 2020 16:50

ZYSzys approved these changes May 22, 2020

View reviewed changes

BridgeAR approved these changes May 23, 2020

View reviewed changes

BridgeAR added the author ready PRs that have at least one approval, no pending requests for changes, and a CI started. label May 23, 2020

targos removed the tsc-agenda Issues and PRs to discuss during the meetings of the TSC. label Jun 5, 2020

aduh95 mentioned this pull request Aug 1, 2020

Inconsistency between new URL behavior in Nodejs and browser #30223

Closed

BethGriggs mentioned this pull request Sep 1, 2020

2020-10-20, Version 15.0.0 (Current) #35014

Merged

targos mentioned this pull request Sep 10, 2020

test: update WPT harness #33770

Closed

137717unity mentioned this pull request May 22, 2023

[Snyk] Security upgrade gatsby-plugin-sharp from 2.3.10 to 3.15.0 137717unity/node#95

Open

snyk-bot mentioned this pull request May 23, 2023

[Snyk] Security upgrade gatsby-plugin-sharp from 2.3.10 to 3.15.0 ron-a20/node#95

Open

wedataintelligence mentioned this pull request May 24, 2023

[Snyk] Security upgrade gatsby-plugin-sharp from 2.3.10 to 3.15.0 wedataintelligence/node#77

Open

baby636 mentioned this pull request May 24, 2023

[Snyk] Security upgrade gatsby-plugin-sharp from 2.6.24 to 3.15.0 baby636/node#92

Open

aliceUnhinged613 mentioned this pull request Nov 25, 2023

[Snyk] Fix for 28 vulnerabilities aliceUnhinged613/node#98

Open

wedataintelligence mentioned this pull request Nov 28, 2023

[Snyk] Fix for 28 vulnerabilities wedataintelligence/node#87

Open

baby636 mentioned this pull request Nov 28, 2023

[Snyk] Fix for 37 vulnerabilities baby636/node#110

Open

ron-a20 mentioned this pull request Dec 19, 2023

[Snyk] Fix for 30 vulnerabilities ron-a20/node#112

Open

137717unity mentioned this pull request Dec 19, 2023

[Snyk] Fix for 30 vulnerabilities 137717unity/node#113

Open

wedataintelligence mentioned this pull request Dec 19, 2023

[Snyk] Fix for 30 vulnerabilities wedataintelligence/node#96

Open

aliceUnhinged613 mentioned this pull request Dec 19, 2023

[Snyk] Fix for 30 vulnerabilities aliceUnhinged613/node#114

Open

baby636 mentioned this pull request Dec 20, 2023

[Snyk] Fix for 43 vulnerabilities baby636/node#126

Open

137717unity mentioned this pull request Apr 14, 2024

[Snyk] Security upgrade gatsby-plugin-sharp from 2.3.10 to 3.15.0 137717unity/node#125

Open

aliceUnhinged613 mentioned this pull request Apr 14, 2024

[Snyk] Security upgrade gatsby-plugin-sharp from 2.3.10 to 3.15.0 aliceUnhinged613/node#125

Open

ron-a20 mentioned this pull request Apr 14, 2024

[Snyk] Security upgrade gatsby-plugin-sharp from 2.3.10 to 3.15.0 ron-a20/node#123

Open

molllyn1 mentioned this pull request Apr 14, 2024

[Snyk] Security upgrade gatsby-plugin-sharp from 2.3.10 to 3.15.0 molllyn1/node#109

Open

kissofire mentioned this pull request Apr 14, 2024

[Snyk] Security upgrade gatsby-plugin-sharp from 2.2.13 to 3.15.0 kissofire/node#126

Open

wedataintelligence mentioned this pull request Apr 14, 2024

[Snyk] Security upgrade gatsby-plugin-sharp from 2.3.10 to 3.15.0 wedataintelligence/node#108

Open

baby636 mentioned this pull request Apr 15, 2024

[Snyk] Security upgrade gatsby-plugin-sharp from 2.6.24 to 3.15.0 baby636/node#146

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

src: forbid lt and gt in url host code point #33328

src: forbid lt and gt in url host code point #33328

yashLadha commented May 9, 2020

addaleax commented May 9, 2020

Trott commented May 10, 2020

jasnell commented May 11, 2020

addaleax commented May 19, 2020

yashLadha commented May 20, 2020

yashLadha commented May 20, 2020

nodejs-github-bot commented May 20, 2020

ZYSzys May 21, 2020

yashLadha May 21, 2020

yashLadha May 21, 2020

nodejs-github-bot commented May 22, 2020

nodejs-github-bot commented May 23, 2020 •

edited by BridgeAR

Loading

BridgeAR commented May 23, 2020

src: forbid lt and gt in url host code point #33328

src: forbid lt and gt in url host code point #33328

Conversation

yashLadha commented May 9, 2020

Checklist

addaleax commented May 9, 2020

Trott commented May 10, 2020

jasnell commented May 11, 2020

addaleax commented May 19, 2020

yashLadha commented May 20, 2020

yashLadha commented May 20, 2020

nodejs-github-bot commented May 20, 2020

ZYSzys May 21, 2020

Choose a reason for hiding this comment

yashLadha May 21, 2020

Choose a reason for hiding this comment

yashLadha May 21, 2020

Choose a reason for hiding this comment

nodejs-github-bot commented May 22, 2020

nodejs-github-bot commented May 23, 2020 • edited by BridgeAR Loading

BridgeAR commented May 23, 2020

nodejs-github-bot commented May 23, 2020 •

edited by BridgeAR

Loading