Sanitising URL instance parameters

[jkyberneees]

Changes:

• Fixes security issue reported by @KaixinChen0512 at someone can use req.url like '//10.10.10.10' to make SSRF attack, cause the host in headers is not expected. #42

Notes on the impact:

• This security issue does NOT impact implementations that rely on fast-gateway, restana or express with prefixed routes such as (app.all('/service', (...))), however it would affect low level implementations such as:

// ...
const service = new http.Server()
service.on('request', (req, res) => {
  proxy(req, res, req.url, {})
})

• We should deprecate lower versions of this package and recommend upgrade ASAP.

Checklist

• run npm run test and npm run benchmark
• tests and/or benchmarks are included
• documentation is changed or added
• commit message and code follows the Developer's Certification of Origin
  and the Code of conduct

[jkyberneees]

Hi @KaixinChen0512, may I kindly ask for your review/comments here as well?
Many thanks in advance.

[KaixinChen0512]

Hi @KaixinChen0512, may I kindly ask for your review/comments here as well?
Many thanks in advance.

Hi @KaixinChen0512, may I kindly ask for your review/comments here as well?
Many thanks in advance.

sure, my pleasure.