Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ionicabizau/parse-path

              master @ cc1e0eb
            

Fixes

CVEs

HIGH

Peak severity

Highlights

SSRF: 2 prior fixes. Scrutinize any change in this area.

lib/index.js: most-fixed (3 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: Fragile custom regex and manual string-splitting for parsing URLs allowed attackers to manipulate the resolved host and protocol. This created critical parser differentials where downstream clients made connections to unexpected destinations, exposing the application to SSRF. The issue was addressed by delegating parsing to the native WHATWG URL API.

Cross-Site Scripting (XSS): Incomplete sanitization of input URLs allowed carriage returns and newlines to bypass javascript: protocol detection. Attackers could structure URLs that bypass naive string matching but execute arbitrary script payloads when interpreted by a browser or client context.

SSRF: Misclassification of protocol-relative URLs starting with '//' as local 'file' protocol paths allowed attackers to craft ambiguous links that subverted routing validation checks, potentially exposing local file paths or unexpected network resources.