Node: Invalid URL

[jimmywarting]

• Version: v10.8.0
• Platform: Darwin
• Subsystem:

This works fine in the browser but fails in node

new URL('http://xn--www-4m0aa.hergivenhair.com/?y=MAKEBA112')

TypeError [ERR_INVALID_URL]: Invalid URL: http://xn--www-4m0aa.hergivenhair.com/?y=MAKEBA112
    at onParseError (internal/url.js:237:17)
    at parse (internal/url.js:246:3)
    at new URL (internal/url.js:321:5)

[jasnell]

Browsers appear to be giving this a bit more leniency but the URL does not appear to be valid punycode.

@TimothyGu ... thoughts?

[targos]

The whatwg-url module also throws with this URL.

[targos]

@jimmywarting what is the original utf-8 name of the domain?

[indobits]

it seems this URL isn't correct one.

[indobits]

@jimmywarting I scanned your domain but I didn't find this subdomain "xn--www-4m0aa"

Pentest-Tools

[jimmywarting]

@jimmywarting what is the original utf-8 name of the domain?

Don't know... there was a bit.ly url that redirects

https://bitly.com/hergivenhairKeeb+

I was looking into this PR https://github.com/bitinn/node-fetch/pull/532
I thought that instead of just throwing a error, i thought: how can we handle it and potentially fix it?

[bnoordhuis]

xn--www-4m0aa decoded is \u200B\u200Bwww. U+200B is the zero-width space.

From a security perspective, I'd say it's right it gets rejected, otherwise it's easy to create URLs that look identical visually.

[jimmywarting]

So everyone here seems to be saying that it's a invalid punycode url. So is Node doing this correctly and the browser dose not?

[jasnell]

Correct. The browsers seem to be falling back to a lenient parse mode that does not actually try to interpret the invalid punycode.

[TimothyGu]

Agreed with all of the above. Note, the latest whatwg-url package also throws when this URL is parsed.

[jasnell]

Closing this as there is consensus that this is not a bug in node.js