express - npm Package Compare versions

Comparing version 5.0.0-beta.2 to 5.0.0-beta.3

lib/response.js

@@ -37,3 +37,2 @@ /*!
 var vary = require('vary');
-var urlParse = require('url').parse;
 
@@ -55,2 +54,9 @@ /**
 /**
+ * Module variables.
+ * @private
+ */
+
+var schemaAndHostRegExp = /^(?:[a-zA-Z][a-zA-Z0-9+.-]*:)?\/\/[^\\\/\?]+/;
+
+/**
  * Set status `code`.
@@ -778,3 +784,3 @@ *
 res.location = function location(url) {
-  var loc = String(url);
+  var loc;
 
@@ -784,23 +790,14 @@ // "back" is an alias for the referrer
     loc = this.req.get('Referrer') || '/';
+  } else {
+    loc = String(url);
   }
 
-  var lowerLoc = loc.toLowerCase();
-  var encodedUrl = encodeUrl(loc);
-  if (lowerLoc.indexOf('https://') === 0 || lowerLoc.indexOf('http://') === 0) {
-    try {
-      var parsedUrl = urlParse(loc);
-      var parsedEncodedUrl = urlParse(encodedUrl);
-      // Because this can encode the host, check that we did not change the host
-      if (parsedUrl.host !== parsedEncodedUrl.host) {
-        // If the host changes after encodeUrl, return the original url
-        return this.set('Location', loc);
-      }
-    } catch (e) {
-      // If parse fails, return the original url
-      return this.set('Location', loc);
-    }
-  }
+  var m = schemaAndHostRegExp.exec(loc);
+  var pos = m ? m[0].length + 1 : 0;
 
-  // set location
-  return this.set('Location', encodedUrl);
+  // Only encode after host to avoid invalid encoding which can introduce
+  // vulnerabilities (e.g. `\\` to `%5C`).
+  loc = loc.slice(0, pos) + encodeUrl(loc.slice(pos));
+
+  return this.set('Location', loc);
 };
@@ -807,0 +804,0 @@

package.json

 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "5.0.0-beta.2",
+  "version": "5.0.0-beta.3",
   "author": "TJ Holowaychuk <[e-mail]>",
@@ -6,0 +6,0 @@ "contributors": [

No alert changes

Improved metrics

Published versions last months

2

increased byInfinity%

Worsened metrics

Total package byte prevSize

189311

decreased by-0.05%

Lines of code

2325

decreased by-0.26%

No dependency changes