Skip to content

doc: clarify url.parse security warning #63344

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
MukundaKatta wants to merge 1 commit into from
+7 −5
Closed

doc: clarify url.parse security warning #63344

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 7 additions & 5 deletions doc/api/url.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1921,11 +1921,13 @@ A `TypeError` is thrown if `urlString` is not a string.

A `URIError` is thrown if the `auth` property is present but cannot be decoded.

`url.parse()` uses a lenient, non-standard algorithm for parsing URL
strings. It is prone to security issues such as [host name spoofing][]
and incorrect handling of usernames and passwords. Do not use with untrusted
input. CVEs are not issued for `url.parse()` vulnerabilities. Use the
[WHATWG URL][] API instead, for example:
`url.parse()` can be used with URLs from trusted input, such as application
configuration. It uses a lenient, non-standard algorithm for parsing URL
strings, so do not use it with untrusted input or when parsed URL components
are used for security decisions. It is prone to security issues such as
[host name spoofing][] and incorrect handling of usernames and passwords. CVEs
are not issued for `url.parse()` vulnerabilities. Use the [WHATWG URL][] API
instead, for example:

```js
function getURL(req) {
Expand Down
Loading