Skip to content

doc: document security issues with url.parse() - #34226

Closed
jasnell wants to merge 3 commits into
nodejs:masterfrom
jasnell:fix-for-31279
Closed

doc: document security issues with url.parse()#34226
jasnell wants to merge 3 commits into
nodejs:masterfrom
jasnell:fix-for-31279

Conversation

@jasnell

@jasnelljasnell commented Jul 6, 2020

Copy link
Copy Markdown
Member

Fixes: #31279

Checklist
  • make -j4 test (UNIX), or vcbuild test (Windows) passes
  • documentation is changed or added
  • commit message follows commit guidelines

@nodejs-github-botnodejs-github-bot added doc Issues and PRs related to the documentations. url Issues and PRs related to the legacy built-in url module. labels Jul 6, 2020
bnoordhuis
bnoordhuis approved these changes Jul 7, 2020
View reviewed changes
Comment threaddoc/api/url.md Outdated
@jasnell@bnoordhuis
[Squash] suggestion
b7eaab8
Co-authored-by: Ben Noordhuis <info@bnoordhuis.nl>
@addaleaxaddaleax added the author ready PRs that have at least one approval, no pending requests for changes, and a CI started. label Jul 7, 2020
Trott
Trott reviewed Jul 9, 2020
View reviewed changes
Comment threaddoc/api/url.md Outdated
Trott
Trott reviewed Jul 9, 2020
View reviewed changes
Comment threaddoc/api/url.md Outdated
Trott
Trott reviewed Jul 9, 2020
View reviewed changes
Comment threaddoc/api/url.md Outdated
Trott
Trott reviewed Jul 9, 2020
View reviewed changes
Comment threaddoc/api/url.md Outdated
Trott
Trott reviewed Jul 9, 2020
View reviewed changes
Comment threaddoc/api/url.md Outdated
Trott
Trott previously requested changes Jul 9, 2020
View reviewed changes

@TrottTrott left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've left a few suggestions and I'd consider two of them mandatory:

  • Use API rather than api
  • Use host name rather than hostname for consistency with our other docs, UNIX man pages, and DNS specifications

Feel free to dismiss this once those things are updated. No need to wait for me to come back to the GitHub interface and do it.

@jasnell@Trott
[squash] nits
81a9ae6
Co-authored-by: Rich Trott <rtrott@gmail.com>
jasnell added a commit that referenced this pull request Jul 9, 2020
@jasnell
doc: document security issues with url.parse()
a95fb93
Fixes: #31279
PR-URL: #34226
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
@jasnell

jasnell commented Jul 9, 2020

Copy link
Copy Markdown
MemberAuthor

Landed in a95fb93

@jasnelljasnell closed this Jul 9, 2020
MylesBorins pushed a commit that referenced this pull request Jul 14, 2020
@jasnell@MylesBorins
doc: document security issues with url.parse()
b403d60
Fixes: #31279
PR-URL: #34226
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
@MylesBorinsMylesBorins mentioned this pull request Jul 14, 2020
Merged
MylesBorins pushed a commit that referenced this pull request Jul 16, 2020
@jasnell@MylesBorins
doc: document security issues with url.parse()
a6a656a
Fixes: #31279
PR-URL: #34226
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
addaleax pushed a commit that referenced this pull request Sep 22, 2020
@jasnell@addaleax
doc: document security issues with url.parse()
fc94e6f
Fixes: #31279
PR-URL: #34226
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
addaleax pushed a commit that referenced this pull request Sep 22, 2020
@jasnell@addaleax
doc: document security issues with url.parse()
0ebb30b
Fixes: #31279
PR-URL: #34226
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
@codebyterecodebytere mentioned this pull request Sep 28, 2020
Merged
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bnoordhuisbnoordhuisbnoordhuis approved these changes
@addaleaxaddaleaxaddaleax approved these changes
@trivikrtrivikrtrivikr approved these changes
@TrottTrottTrott left review comments

Assignees

No one assigned

Labels

author readyPRs that have at least one approval, no pending requests for changes, and a CI started.docIssues and PRs related to the documentations.urlIssues and PRs related to the legacy built-in url module.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

security implications of legacy url.parse() should be more clearly documented

6 participants

@jasnell@bnoordhuis@Trott@addaleax@trivikr@nodejs-github-bot