js-url

js-url copied to clipboard

Hey there! I belong to an open source security research community, and a member (@abdshaleh) has found an issue, but doesn’t know the best way to disclose it. If not...

JamieSlome

Issues parsing array arguments?

2

Not sure if people consider this an issues, however, arrays are apparently padded with nulls for missing values, ``` > JSON.stringify(url('?','?t[0]=x&t[1]=y')); "{"t":["x","y"]}" > JSON.stringify(url('?','?t[0]=x&t[2]=y')); "{"t":["x",null,"y"]}" ``` Maybe the better option...

maxguru

Multidimensional arrays are not parsed correctly, ``` > JSON.stringify(url('?','?t[0][0]=x')); "{"t[0]":["x"]}" > JSON.stringify(url('?','?t[0][0]=x&t[1][0]=y')); "{"t[0]":["x"],"t[1]":["y"]}" ``` The expected behavior is as follows, ``` > JSON.stringify(url('?','?t[0][0]=x')); "{"t":[["x"]]}" > JSON.stringify(url('?','?t[0][0]=x&t[1][0]=y')); "{"t":[["x"],["y"]]}" ```

maxguru

There seems to be an issue parsing non-numeric keys in array arguments. Check out the following, ``` > JSON.stringify(url('?','?t[0]=x&t[1]=y')); "{"t":["x","y"]}" > JSON.stringify(url('?','?t[a]=x&t[b]=y')); "{"t[a]":"x","t[b]":"y"}" ``` The expected behavior is, ``` >...

maxguru

Found this issue: When trying to parse the following url: `https://facebook.com\@account.google.com/x` ```js url('domain', 'https://facebook.com\@account.google.com/x') // outputs 'google.com' ``` This outputs `google.com` as the domain instead of `facebook.com`

shidhincr