Skip to content

Commit

Permalink
Ensure that binary characters are escaped correctly in the location h…
Browse files Browse the repository at this point in the history
…eader
  • Loading branch information
netroy committed Feb 21, 2024
1 parent b1677ce commit 5a6e8c4
Show file tree
Hide file tree
Showing 2 changed files with 22 additions and 0 deletions.
2 changes: 2 additions & 0 deletions index.js
Original file line number Diff line number Diff line change
Expand Up @@ -567,6 +567,8 @@ function parseUrl(input) {
}

function resolveUrl(relative, base) {
// Ensure that any non-ascii characters are escaped correctly as a valid URI
relative = encodeURI(Buffer.from(relative, 'binary').toString('utf8'))

Check failure on line 571 in index.js

View workflow job for this annotation

GitHub Actions / lint

Strings must use doublequote

Check failure on line 571 in index.js

View workflow job for this annotation

GitHub Actions / lint

Strings must use doublequote

Check failure on line 571 in index.js

View workflow job for this annotation

GitHub Actions / lint

Missing semicolon
/* istanbul ignore next */
return useNativeURL ? new URL(relative, base) : parseUrl(url.resolve(base, relative));
}
Expand Down
20 changes: 20 additions & 0 deletions test/test.js
Original file line number Diff line number Diff line change
Expand Up @@ -394,6 +394,26 @@ describe("follow-redirects", function () {
});
});

it("should escape utf-8 characters in the url correctly", function () {
app.get("/a", redirectsTo("/b"));
app.get("/b", (_, res) => {
res.statusCode = 302;
res.set('Location', "http://localhost:3600/¢");

Check failure on line 401 in test/test.js

View workflow job for this annotation

GitHub Actions / lint

Strings must use doublequote
res.end();
});
app.get("/%C2%A2", redirectsTo("/d"));
app.get("/d", sendsJson({ a: "b" }));

return server.start(app)
.then(asPromise(function (resolve, reject) {
http.get("http://localhost:3600/a", concatJson(resolve, reject)).on("error", reject);
}))
.then(function (res) {
assert.deepEqual(res.parsedJson, { a: "b" });
assert.deepEqual(res.responseUrl, "http://localhost:3600/d");
});
});

it("should return with the original status code if the response does not contain a location header", function () {
app.get("/a", function (req, res) {
res.status(307).end();
Expand Down

0 comments on commit 5a6e8c4

Please sign in to comment.