File tree Expand file tree Collapse file tree 1 file changed +9
-1
lines changed Expand file tree Collapse file tree 1 file changed +9
-1
lines changed Original file line number Diff line number Diff line change @@ -1841,7 +1841,15 @@ A `URIError` is thrown if the `auth` property is present but cannot be decoded.
1841
1841
strings . It is prone to security issues such as [host name spoofing][]
1842
1842
and incorrect handling of usernames and passwords . Do not use with untrusted
1843
1843
input . CVEs are not issued for ` url.parse()` vulnerabilities . Use the
1844
- [WHATWG URL ][] API instead.
1844
+ [WHATWG URL ][] API instead, for example:
1845
+
1846
+ ` ` ` js
1847
+ function getURL(req) {
1848
+ const proto = req.headers['x-forwarded-proto'] || 'https';
1849
+ const host = req.headers['x-forwarded-host'] || req.headers.host || 'example.com';
1850
+ return new URL(req.url || '/', ` ${proto}: // ${host}`);
1851
+ }
1852
+ ` ` `
1845
1853
1846
1854
### ` url .resolve (from, to)`
1847
1855
You can’t perform that action at this time.
0 commit comments