Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ionicabizau/parse-url

              master @ bc71f7e
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

SSRF: 2 prior fixes. Scrutinize any change in this area.

lib/index.js: most-fixed (2 issues). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: Insecure URL pattern matching allowed attackers to bypass protocol checks by manipulating regular expressions. Specifically, the library failed to anchor the git and HTTP protocol regexes to the start of the string, allowing file protocol spoofing.

SSRF: Misclassification of protocol-relative URLs starting with '//' as local 'file' protocol paths allowed bypass of external resource restrictions, exposing applications using the parser to validation bypasses.