Skip to content

Loose base URL check can crash URL parser #204

@rubycon

Description

@rubycon

What is the issue with the URL Pattern Standard?

According to the current spec, when initialize is called with a string input and a null baseURL, the URL parser behavior can be unexpected.

new URLPattern("https://example.com:8080/foo?bar#baz");

With a string input, init["baseURL"] is always set to the value of baseURL (null in our case). Cf. 3. Set init["baseURL"] to baseURL.

The init object is then passed to process a URLPatternInit and the steps will branch to 11. If init["baseURL"] exists: with a null value. URL spec's internal parser is then called with an unexpected null value (string expected) and will likely fail in someway depending on the implementation.

This issue is similar to #202 as both issues come from calling the URL spec's internal parser without properly checking the input arguments or the return value.

I also think that using map exists to check if values are properly set is maybe not the most robust practice as map exists can be true even if the value associated with the key is null or undefined.

Maybe the base URL contains/exists checks in process a URLPatternInit could be replace with more explicit type check (non empty string, integer or path list). It could avoid unnecessary processing, unfiltered call to the URL parser and maybe fix some non-intuitive behaviors (cf. #200).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions