Executive brief
url-parse is a JavaScript library used to parse URLs and extract components like hostname and protocol. When URLs contain leading control characters, url-parse fails to strip them and misinterprets the URL structure, while standard web parsers handle them correctly. This can enable attackers to bypass security filters that rely on url-parse for protocol validation, potentially leading to XSS attacks through malicious javascript: protocol URLs.
Technical details
url-parse fails to strip leading control characters (e.g., \b, null bytes) from URLs before parsing, whereas the WHATWG URL standard parser trims these characters. This causes url-parse to misclassify absolute URLs (containing hostname and protocol) as relative URLs when preceded by control characters. The vulnerability is rooted in the custom MOARE regex parser introduced in version 0.1.0; versions 0.0.0–0.0.4 delegated parsing to platform implementations (Node.js url.parse or DOM) and are unaffected. An attacker can exploit this discrepancy in security-critical contexts: if an application uses url-parse to validate that a URL does not use the javascript: protocol before rendering it in HTML, a URL like "\bjavascript:alert(1)" will bypass the check. The application would then pass the URL to a browser or other WHATWG-compliant parser, which strips the control character and interprets it as a javascript: URL, leading to XSS. The fix was released in version 1.5.9.
Affected products
- unshiftio url-parse 0.1.0 to 1.5.8
Timeline
- 2022-02-22: disclosed
- 2022-02-22: patched: version 1.5.9