Reject protocol relative URLs unless the flag is set, fixes #860

validatorjs · Jul 31, 2018 · ae81250 · ae81250
1 parent 5733145
commit ae81250
Show file tree

Hide file tree

Showing 6 changed files with 16 additions and 4 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -8,6 +8,8 @@
   ([#848](https://github.com/chriso/validator.js/pull/848))
 - Added a `no_colons` option to `isMACAddress()`
   ([#849](https://github.com/chriso/validator.js/pull/849))
+- Updated `isURL()` to reject protocol relative URLs unless a flag is set
+  ([#860](https://github.com/chriso/validator.js/issues/860))
 - New and improved locales
   ([#801](https://github.com/chriso/validator.js/pull/801),
    [#856](https://github.com/chriso/validator.js/pull/856),

diff --git a/lib/isURL.js b/lib/isURL.js
@@ -82,7 +82,10 @@ function isURL(url, options) {
     }
   } else if (options.require_protocol) {
     return false;
-  } else if (options.allow_protocol_relative_urls && url.substr(0, 2) === '//') {
+  } else if (url.substr(0, 2) === '//') {
+    if (!options.allow_protocol_relative_urls) {
+      return false;
+    }
     split[0] = url.substr(2);
   }
   url = split.join('://');

diff --git a/src/lib/isURL.js b/src/lib/isURL.js
@@ -56,7 +56,10 @@ export default function isURL(url, options) {
     }
   } else if (options.require_protocol) {
     return false;
-  } else if (options.allow_protocol_relative_urls && url.substr(0, 2) === '//') {
+  } else if (url.substr(0, 2) === '//') {
+    if (!options.allow_protocol_relative_urls) {
+      return false;
+    }
     split[0] = url.substr(2);
   }
   url = split.join('://');

diff --git a/test/validators.js b/test/validators.js
@@ -302,6 +302,7 @@ describe('Validators', () => {
       ],
       invalid: [
         'http://localhost:3000/',
+        '//foobar.com',
         'xyz://foobar.com',
         'invalid/',
         'invalid.x',

diff --git a/validator.js b/validator.js
@@ -402,7 +402,10 @@ function isURL(url, options) {
     }
   } else if (options.require_protocol) {
     return false;
-  } else if (options.allow_protocol_relative_urls && url.substr(0, 2) === '//') {
+  } else if (url.substr(0, 2) === '//') {
+    if (!options.allow_protocol_relative_urls) {
+      return false;
+    }
     split[0] = url.substr(2);
   }
   url = split.join('://');

diff --git a/validator.min.js b/validator.min.js