Fix authority parsing in Closure URI parser.

RELNOTES: Fix authority parsing in Closure URI parser. PiperOrigin-RevId: 300815722
google · Mar 14, 2020 · 294fc00 · 294fc00
1 parent 49624ab
commit 294fc00
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 6 deletions.
diff --git a/closure/goog/uri/utils.js b/closure/goog/uri/utils.js
@@ -173,25 +173,31 @@ goog.uri.utils.buildFromEncodedParts = function(
  *    $6 = <undefined>       query without ?
  *    $7 = Related           fragment without #
  * </pre>
+ *
+ * TODO(user): separate out the authority terminating characters once this
+ * file is moved to ES6.
  * @type {!RegExp}
  * @private
  */
 goog.uri.utils.splitRe_ = new RegExp(
-    '^' +
+    '^' +  // Anchor against the entire string.
     '(?:' +
     '([^:/?#.]+)' +  // scheme - ignore special characters
                      // used by other URL parts such as :,
                      // ?, /, #, and .
     ':)?' +
     '(?://' +
-    '(?:([^/?#]*)@)?' +  // userInfo
-    '([^/#?]*?)' +       // domain
-    '(?::([0-9]+))?' +   // port
-    '(?=[/\\\\#?]|$)' +  // authority-terminating character
+    '(?:([^\\\\/?#]*)@)?' +  // userInfo
+    '([^\\\\/?#]*?)' +       // domain
+    '(?::([0-9]+))?' +       // port
+    '(?=[\\\\/?#]|$)' +      // authority-terminating character.
     ')?' +
     '([^?#]+)?' +          // path
     '(?:\\?([^#]*))?' +    // query
-    '(?:#([\\s\\S]*))?' +  // fragment
+    '(?:#([\\s\\S]*))?' +  // fragment. Can't use '.*' with 's' flag as Firefox
+                           // doesn't support the flag, and can't use an
+                           // "everything set" ([^]) as IE10 doesn't match any
+                           // characters with it.
     '$');
 
 

diff --git a/closure/goog/uri/utils_test.js b/closure/goog/uri/utils_test.js
@@ -111,6 +111,19 @@ testSuite({
     assertNull(utils.getFragment(uri));
   },
 
+  testSplitMaliciousUriUsername() {
+    const uri = 'https://malicious.com\\@test.google.com';
+    assertEquals('https', utils.getScheme(uri));
+    assertEquals('malicious.com', utils.getDomain(uri));
+    assertEquals('malicious.com', utils.getDomainEncoded(uri));
+    assertNull(utils.getPort(uri));
+    assertEquals('\\@test.google.com', utils.getPathEncoded(uri));
+    assertEquals('\\@test.google.com', utils.getPath(uri));
+    assertNull(utils.getQueryData(uri));
+    assertNull(utils.getFragmentEncoded(uri));
+    assertNull(utils.getFragment(uri));
+  },
+
   testSplitBadAuthority() {
     // This URL has a syntax error per the RFC (port number must be digits, and
     // host cannot contain a colon except in [...]). This test is solely to