Skip to content

Commit ebd7f64

Browse files
authored
feat: use new URL instead of url.parse (#5637)
1 parent 18704b6 commit ebd7f64

File tree

2 files changed

+31
-21
lines changed

2 files changed

+31
-21
lines changed

lib/Server.js

Lines changed: 30 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -3050,6 +3050,32 @@ class Server {
30503050
return false;
30513051
}
30523052

3053+
/**
3054+
* Extracts and normalizes the hostname from a header, removing brackets for IPv6.
3055+
* @param {string} header header value
3056+
* @returns {string|null} hostname or null
3057+
*/
3058+
#parseHostnameFromHeader = function (header) {
3059+
if (!header) return null;
3060+
try {
3061+
// If the header does not have a scheme, prepend // so URL can parse it
3062+
const parseUrl = new URL(
3063+
/^(.+:)?\/\//.test(header) ? header : `//${header}`,
3064+
"http://localhost/",
3065+
);
3066+
3067+
let hostname = parseUrl.hostname;
3068+
// Normalize IPv6: remove brackets if present
3069+
if (hostname.startsWith("[") && hostname.endsWith("]")) {
3070+
hostname = hostname.slice(1, -1);
3071+
}
3072+
3073+
return hostname;
3074+
} catch {
3075+
return null;
3076+
}
3077+
};
3078+
30533079
/**
30543080
* @private
30553081
* @param {{ [key: string]: string | undefined }} headers headers
@@ -3074,15 +3100,7 @@ class Server {
30743100
return true;
30753101
}
30763102

3077-
// use the node url-parser to retrieve the hostname from the host-header.
3078-
// TODO resolve me in the next major release
3079-
// eslint-disable-next-line n/no-deprecated-api
3080-
const { hostname } = url.parse(
3081-
// if header doesn't have scheme, add // for parsing.
3082-
/^(.+:)?\/\//.test(header) ? header : `//${header}`,
3083-
false,
3084-
true,
3085-
);
3103+
const hostname = this.#parseHostnameFromHeader(header);
30863104

30873105
if (hostname === null) {
30883106
return false;
@@ -3096,8 +3114,7 @@ class Server {
30963114
// A note on IPv6 addresses:
30973115
// header will always contain the brackets denoting
30983116
// an IPv6-address in URLs,
3099-
// these are removed from the hostname in url.parse(),
3100-
// so we have the pure IPv6-address in hostname.
3117+
// these aren't removed from the hostname in new URL(),
31013118
// For convenience, always allow localhost (hostname === 'localhost')
31023119
// and its subdomains (hostname.endsWith(".localhost")).
31033120
// allow hostname of listening address (hostname === this.options.host)
@@ -3132,9 +3149,7 @@ class Server {
31323149
return true;
31333150
}
31343151

3135-
// TODO resolve me in the next major release
3136-
// eslint-disable-next-line n/no-deprecated-api
3137-
const origin = url.parse(originHeader, false, true).hostname;
3152+
const origin = this.#parseHostnameFromHeader(originHeader);
31383153

31393154
if (origin === null) {
31403155
return false;
@@ -3154,13 +3169,7 @@ class Server {
31543169
return true;
31553170
}
31563171

3157-
// eslint-disable-next-line n/no-deprecated-api
3158-
const host = url.parse(
3159-
// if hostHeader doesn't have scheme, add // for parsing.
3160-
/^(.+:)?\/\//.test(hostHeader) ? hostHeader : `//${hostHeader}`,
3161-
false,
3162-
true,
3163-
).hostname;
3172+
const host = this.#parseHostnameFromHeader(hostHeader);
31643173

31653174
if (host === null) {
31663175
return false;

types/lib/Server.d.ts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1409,6 +1409,7 @@ declare class Server<
14091409
* @param {((err?: Error) => void)=} callback callback
14101410
*/
14111411
stopCallback(callback?: ((err?: Error) => void) | undefined): void;
1412+
#private;
14121413
}
14131414
declare namespace Server {
14141415
export {

0 commit comments

Comments
 (0)