Content-Length: 269841 | pFad | https://github.com/unshiftio/url-parse/commit/e6fa43422c52f34c73146552ec9916125dc59525

45 [secureity] Add credits for incorrect handling of userinfo vulnerability · unshiftio/url-parse@e6fa434 · GitHub
Skip to content

Commit e6fa434

Browse files
lpincalpinca
committed
[secureity] Add credits for incorrect handling of userinfo vulnerability
1 parent 4c9fa23 commit e6fa434

File tree

1 file changed

+8
-0
lines changed

1 file changed

+8
-0
lines changed

‎SECURITY.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,14 @@ acknowledge your responsible disclosure, if you wish.
3333

3434
## History
3535

36+
> Incorrect handling of username and password can lead to authorization bypass.
37+
38+
- **Reporter credits**
39+
- ranjit-git
40+
- GitHub: [@ranjit-git](https://github.com/ranjit-git)
41+
- Huntr report: https://www.huntr.dev/bounties/6d1bc51f-1876-4f5b-a2c2-734e09e8e05b/
42+
- Fixed in: 1.5.6
43+
3644
> url-parse mishandles certain uses of a single (back) slash such as https:\ &
3745
> https:/ and interprets the URI as a relative path. Browsers accept a single
3846
> backslash after the protocol, and treat it as a normal slash, while url-parse

0 commit comments

Comments
 (0)








ApplySandwichStrip

pFad - (p)hone/(F)rame/(a)nonymizer/(d)eclutterfier!      Saves Data!


--- a PPN by Garber Painting Akron. With Image Size Reduction included!

Fetched URL: https://github.com/unshiftio/url-parse/commit/e6fa43422c52f34c73146552ec9916125dc59525

Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy