feat(sandbox): add url to QuickJS module registry - #10378
Draft
kwburns-kong wants to merge 4 commits into
Draft
Conversation
Legacy parse()/format() verified against node:url (protocol/opaque/
non-slash forms, auth/port/query/hash, escaping, IPv6 hosts), plus a
thin re-export of the ambient URL/URLSearchParams globals matching
real Node's own require('url').URL === global.URL identity.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| ['javascript://foo/bar', false], | ||
| ['javascript:alert(1)?x=1#y', false], | ||
| ['ws:no-slash', false], | ||
| ['ws://host/path', false], |
✅ Circular References ReportGenerated at: 2026-08-11T18:01:23.795Z Summary
Click to view all circular references in PR (9)Click to view all circular references in base branch (9)Analysis✅ No Change: This PR does not introduce or remove any circular references. This report was generated automatically by comparing against the |
… gaps Regression cases proving the sandboxed url module's parse() doesn't strip leading/trailing C0-control-or-space bytes before parsing (letting a leading control byte hide a scheme from protocol detection) and that the unsafe-character escape table is missing a single-quote entry, both against real node:url. Intentionally red pending the fix.
parse() only called .trim(), which doesn't cover most C0 control bytes, so a leading control byte before a scheme (e.g. a NUL before "javascript:") went undetected as a protocol where real node:url and every browser recognize it, after stripping the same bytes per the WHATWG URL Standard's input-trimming step. Also adds the missing single-quote entry to the unsafe-character escape table, matching real node:url.
…rse() A backslash is fully interchangeable with a forward slash in real Node's legacy url.parse (delimiter, and a stand-in for "//" after the protocol) — match it exactly rather than diverging, so a plugin ported from the legacy sandbox behaves identically. The function has no host-capability surface either way, so parity costs nothing here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Milestone 7 of the QuickJS legacy-module porting plan. Adds
require('url'): legacyparse()/format()(verified againstnode:urlacross protocol/opaque/non-slash-protocol forms, auth/port/query/hash splitting, the unsafe-character escaping table,parseQueryString/slashesDenoteHost, and IPv6 bracketed hosts), plus a thin re-export of the ambientURL/URLSearchParamsglobals (M2) — matching real Node's ownrequire('url').URL === global.URLidentity.Two documented, intentional divergences from real Node (see
PERMISSIONS.md):parse()'s IPv6 hostname convention (bracket-stripped, matchingnode:urlrather than the WHATWG-style bracket-inclusiveURLglobal), and no backslash-as-delimiter handling — the exact legacy behavior Node's own deprecation notice onurl.parsecites as having "security implications."Draft pending Milestone 7b security review.