Connection problem with IPv6 addresses

[atimin]

Hello,
we are trying to use MQTT.js with IPv6 addresses but we can't connect an MQTT broker:

client = mqtt.connect('ws://[::1]:9001');

This code throws an exception:

 'WebSocket': The URL 'ws://::1:9001/' is invalid.

It seems the library skips []. I've checked this URL with another library. It works fine.

AB#8505545

[seriousme]

Hi,

I did some digging and the problem seems to be in Nodejs url.parse used in lib/connect/index.js

url.parse('ws://[::1]:9001/',true)
Url {
  protocol: 'ws:',
  slashes: true,
  auth: null,
  host: '[::1]:9001',
  port: '9001',
  hostname: '::1',
  hash: null,
  search: null,
  query: [Object: null prototype] {},
  pathname: '/',
  path: '/',
  href: 'ws://[::1]:9001/'
}

as you can see the brackets are in the host but not in the hostname anymore.

Whereas the URL constructor works fine:

new URL('ws://[::1]:9001/')
URL {
  href: 'ws://[::1]:9001/',
  origin: 'ws://[::1]:9001',
  protocol: 'ws:',
  username: '',
  password: '',
  host: '[::1]:9001',
  hostname: '[::1]',
  port: '9001',
  pathname: '/',
  search: '',
  searchParams: URLSearchParams {},
  hash: ''
}

Node's documentation is quite clear on the subject:

Use of the legacy url.parse() method is discouraged. Users should use the WHATWG URL API. Because the url.parse() method 
uses a lenient, non-standard algorithm for parsing URL strings, security issues can be introduced. Specifically, issues with host 
name spoofing and incorrect handling of usernames and passwords have been identified.

An obvious fix seems to be to replace var parsed = url.parse(brokerUrl, true) by var parsed = new URL(brokerUrl) but I haven't tested it. There are a few more places where url.parse is used. So whoever is going to fix this might want to fix them too.

Kind regards,
Hans

[seriousme]

It turned out to be a bit more work as the URL class is a bit special.

I got a version working (although CI fails on node 10 due to a unrelated problem) at https://github.com/seriousme/MQTT.js/tree/replace-url-parse-by-url-class

I can do a PR if you like.

Kind regards,
Hans