Skip to content
This repository has been archived by the owner on Apr 22, 2023. It is now read-only.
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: nodejs/node-v0.x-archive
base: c4f6c22c2033
Choose a base ref
...
head repository: nodejs/node-v0.x-archive
compare: 612047203618
Choose a head ref
  • 1 commit
  • 2 files changed
  • 1 contributor

Commits on Dec 3, 2014

  1. url: change hostname regex to negate invalid chars 

    Regarding #8520

This changes hostname validation from a whitelist regex approach
to a blacklist regex approach as described in https://url.spec.whatwg.org/#host-parsing.

url.parse misinterpreted `https://good.com+.evil.org/`
as `https://good.com/+.evil.org/`.  If we use url.parse to check the
validity of the hostname, the test passes, but in the browser the
user is redirected to the evil.org website.
    @jondavidjohn @trevnorris
    jondavidjohn authored and trevnorris committed Dec 3, 2014
    Copy the full SHA
    6120472 View commit details
    Browse the repository at this point in the history