Merge branch 'master' into gh-pages

Author: rodneyrehm

CHANGELOG.md

@@ -2,6 +2,9 @@
 
 The release notes tracked in this document are also made available on the [releases page](https://github.com/medialize/URI.js/releases)
 
+### 1.19.3 (December 20th 2020) ###
+
+* **SECURITY** fixing [`URI.parseAuthority()`](http://medialize.github.io/URI.js/docs.html#static-parseAuthority) to rewrite `\` to `/` as Node and Browsers do - disclosed privately, relates to [Issue #233](https://github.com/medialize/URI.js/pull/233)
 ### 1.19.2 (October 20th 2019) ###
 
 * fixing [`URI.build()`](http://medialize.github.io/URI.js/docs.html#static-build) to properly handle relative paths when a scheme is given - [Issue #387](https://github.com/medialize/URI.js/issues/387)

bower.json

@@ -1,6 +1,6 @@
 {
   "name": "urijs",
-  "version": "1.19.2",
+  "version": "1.19.3",
   "main": "src/URI.js",
   "ignore": [
     ".*",

build.js

@@ -29,7 +29,7 @@ function build(files) {
             output_format: "text",
             output_info: "compiled_code"
         }, function(data) {
-            var code = "/*! URI.js v1.19.2 http://medialize.github.io/URI.js/ */\n/* build contains: " + files.join(', ') + " */\n" + data;
+            var code = "/*! URI.js v1.19.3 http://medialize.github.io/URI.js/ */\n/* build contains: " + files.join(', ') + " */\n" + data;
             $progress.hide();
             $out.val(code).parent().show();
             $out.prev().find('a').remove();

package.json

@@ -1,6 +1,6 @@
 {
   "name": "urijs",
-  "version": "1.19.2",
+  "version": "1.19.3",
   "title": "URI.js - Mutating URLs",
   "author": {
     "name": "Rodney Rehm",

src/IPv6.js

@@ -2,7 +2,7 @@
  * URI.js - Mutating URLs
  * IPv6 Support
  *
- * Version: 1.19.2
+ * Version: 1.19.3
  *
  * Author: Rodney Rehm
  * Web: http://medialize.github.io/URI.js/

src/SecondLevelDomains.js

@@ -2,7 +2,7 @@
  * URI.js - Mutating URLs
  * Second Level Domain (SLD) Support
  *
- * Version: 1.19.2
+ * Version: 1.19.3
  *
  * Author: Rodney Rehm
  * Web: http://medialize.github.io/URI.js/

src/URI.js

@@ -1,7 +1,7 @@
 /*!
  * URI.js - Mutating URLs
  *
- * Version: 1.19.2
+ * Version: 1.19.3
  *
  * Author: Rodney Rehm
  * Web: http://medialize.github.io/URI.js/
@@ -81,7 +81,7 @@
     return /^[0-9]+$/.test(value);
   }
 
-  URI.version = '1.19.2';
+  URI.version = '1.19.3';
 
   var p = URI.prototype;
   var hasOwn = Object.prototype.hasOwnProperty;
@@ -612,12 +612,14 @@
   };
   URI.parseUserinfo = function(string, parts) {
     // extract username:password
+    var firstBackSlash = string.indexOf('\\');
     var firstSlash = string.indexOf('/');
+    var slash = firstBackSlash === -1 ? firstSlash : (firstSlash !== -1 ? Math.min(firstBackSlash, firstSlash): firstSlash)
     var pos = string.lastIndexOf('@', firstSlash > -1 ? firstSlash : string.length - 1);
     var t;
 
-    // authority@ must come before /path
-    if (pos > -1 && (firstSlash === -1 || pos < firstSlash)) {
+    // authority@ must come before /path or \path
+    if (pos > -1 && (slash === -1 || pos < slash)) {
       t = string.substring(0, pos).split(':');
       parts.username = t[0] ? URI.decode(t[0]) : null;
       t.shift();

src/URI.min.js

@@ -2,7 +2,7 @@
  * URI.js - Mutating URLs
  * URI Template Support - http://tools.ietf.org/html/rfc6570
  *
- * Version: 1.19.2
+ * Version: 1.19.3
  *
  * Author: Rodney Rehm
  * Web: http://medialize.github.io/URI.js/

src/URITemplate.js

@@ -2,7 +2,7 @@
  * URI.js - Mutating URLs
  * jQuery Plugin
  *
- * Version: 1.19.2
+ * Version: 1.19.3
  *
  * Author: Rodney Rehm
  * Web: http://medialize.github.io/URI.js/jquery-uri-plugin.html

src/jquery.URI.js

@@ -1984,6 +1984,55 @@ var urls = [{
         idn: false,
         punycode: false
       }
+    }, {
+      name: 'backslashes authority',
+      url: 'https://attacker.com\\@example.com/some/directory/file.html?query=string#fragment',
+      _url: 'https://attacker.com/@example.com/some/directory/file.html?query=string#fragment',
+      parts: {
+        protocol: 'https',
+        username: null,
+        password: null,
+        hostname: 'attacker.com',
+        port: null,
+        path: '/@example.com/some/directory/file.html',
+        query: 'query=string',
+        fragment: 'fragment'
+      },
+      accessors: {
+        protocol: 'https',
+        username: '',
+        password: '',
+        port: '',
+        path: '/@example.com/some/directory/file.html',
+        query: 'query=string',
+        fragment: 'fragment',
+        resource: '/@example.com/some/directory/file.html?query=string#fragment',
+        authority: 'attacker.com',
+        origin: 'https://attacker.com',
+        userinfo: '',
+        subdomain: '',
+        domain: 'attacker.com',
+        tld: 'com',
+        directory: '/@example.com/some/directory',
+        filename: 'file.html',
+        suffix: 'html',
+        hash: '#fragment',
+        search: '?query=string',
+        host: 'attacker.com',
+        hostname: 'attacker.com'
+      },
+      is: {
+        urn: false,
+        url: true,
+        relative: false,
+        name: true,
+        sld: false,
+        ip: false,
+        ip4: false,
+        ip6: false,
+        idn: false,
+        punycode: false
+      }
     }
 ];