From 476c1ee7656d6b750e0a9711f5e2789b7b1f53e8 Mon Sep 17 00:00:00 2001 From: Yagiz Nizipli Date: Tue, 21 Mar 2023 15:38:12 -0400 Subject: [PATCH 1/2] url: add pending-deprecation to `url.parse()` --- doc/api/deprecations.md | 5 ++++- lib/url.js | 15 +++++++++++++++ 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/doc/api/deprecations.md b/doc/api/deprecations.md index 95f53d05768589..acb9197f95d9c4 100644 --- a/doc/api/deprecations.md +++ b/doc/api/deprecations.md @@ -3288,6 +3288,9 @@ Node-API callbacks. -Type: Documentation-only +Type: Documentation-only (supports [`--pending-deprecation`][]) [`url.parse()`][] behavior is not standardized and prone to errors that have security implications. Use the [WHATWG URL API][] instead. CVEs are not diff --git a/lib/url.js b/lib/url.js index 45ecf043f95282..84e875778eeae4 100644 --- a/lib/url.js +++ b/lib/url.js @@ -62,6 +62,8 @@ const { formatUrl, } = internalBinding('url'); +const { getOptionValue } = require('internal/options'); + // Original url.parse() API function Url() { @@ -146,7 +148,20 @@ const { CHAR_COLON, } = require('internal/constants'); +let urlParseWarned = false; + function urlParse(url, parseQueryString, slashesDenoteHost) { + if (getOptionValue('--pending-deprecation') && !urlParseWarned) { + urlParseWarned = true; + process.emitWarning( + '`url.parse()` behavior is not standardized and prone to ' + + 'errors that have security implications. Use the WHATWG URL API ' + + 'instead. CVEs are not issued for `url.parse()` vulnerabilities.', + 'DeprecationWarning', + 'DEP0169', + ); + } + if (url instanceof Url) return url; const urlObject = new Url(); From e2d17c666ea7b3cb64381d14d47567c048074bcc Mon Sep 17 00:00:00 2001 From: Yagiz Nizipli Date: Wed, 22 Mar 2023 09:45:31 -0400 Subject: [PATCH 2/2] fixup! url: add pending-deprecation to `url.parse()` --- lib/url.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/url.js b/lib/url.js index 84e875778eeae4..e6450c9725402d 100644 --- a/lib/url.js +++ b/lib/url.js @@ -151,7 +151,7 @@ const { let urlParseWarned = false; function urlParse(url, parseQueryString, slashesDenoteHost) { - if (getOptionValue('--pending-deprecation') && !urlParseWarned) { + if (!urlParseWarned && getOptionValue('--pending-deprecation')) { urlParseWarned = true; process.emitWarning( '`url.parse()` behavior is not standardized and prone to ' +