Skip to content

Commit

Permalink
url: runtime deprecate url.parse
Browse files Browse the repository at this point in the history
  • Loading branch information
anonrig committed Sep 19, 2024
1 parent 291d90a commit 800bb15
Show file tree
Hide file tree
Showing 2 changed files with 7 additions and 18 deletions.
2 changes: 1 addition & 1 deletion doc/api/deprecations.md
Original file line number Diff line number Diff line change
Expand Up @@ -3453,7 +3453,7 @@ changes:
description: Documentation-only deprecation.
-->

Type: Documentation-only (supports [`--pending-deprecation`][])
Type: Runtime

[`url.parse()`][] behavior is not standardized and prone to errors that
have security implications. Use the [WHATWG URL API][] instead. CVEs are not
Expand Down
23 changes: 6 additions & 17 deletions lib/url.js
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ const {

// This ensures setURLConstructor() is called before the native
// URL::ToObject() method is used.
const { spliceOne } = require('internal/util');
const { spliceOne, deprecate } = require('internal/util');

// WHATWG URL implementation provided by internal/url
const {
Expand All @@ -63,8 +63,6 @@ const {

const bindingUrl = internalBinding('url');

const { getOptionValue } = require('internal/options');

// Original url.parse() API

function Url() {
Expand Down Expand Up @@ -122,20 +120,7 @@ const {
CHAR_COLON,
} = require('internal/constants');

let urlParseWarned = false;

function urlParse(url, parseQueryString, slashesDenoteHost) {
if (!urlParseWarned && getOptionValue('--pending-deprecation')) {
urlParseWarned = true;
process.emitWarning(
'`url.parse()` behavior is not standardized and prone to ' +
'errors that have security implications. Use the WHATWG URL API ' +
'instead. CVEs are not issued for `url.parse()` vulnerabilities.',
'DeprecationWarning',
'DEP0169',
);
}

if (url instanceof Url) return url;

const urlObject = new Url();
Expand Down Expand Up @@ -1023,7 +1008,11 @@ function pathToFileURL(path, options) {
module.exports = {
// Original API
Url,
parse: urlParse,
parse: deprecate(
urlParse,
'url.parse() is deprecated and the behavior is prone to ' +
'errors that have security implications. Use new URL() instead.',
'DEP0169'),
resolve: urlResolve,
resolveObject: urlResolveObject,
format: urlFormat,
Expand Down

0 comments on commit 800bb15

Please sign in to comment.