@@ -34,7 +34,6 @@ var extname = path.extname;
34
34
var mime = send . mime ;
35
35
var resolve = path . resolve ;
36
36
var vary = require ( 'vary' ) ;
37
- var urlParse = require ( 'url' ) . parse ;
38
37
39
38
/**
40
39
* Response prototype.
@@ -56,6 +55,7 @@ module.exports = res
56
55
*/
57
56
58
57
var charsetRegExp = / ; \s * c h a r s e t \s * = / ;
58
+ var schemaAndHostRegExp = / ^ (?: [ a - z A - Z ] [ a - z A - Z 0 - 9 + . - ] * : ) ? \/ \/ [ ^ \\ \/ \? ] + / ;
59
59
60
60
/**
61
61
* Set status `code`.
@@ -905,32 +905,23 @@ res.cookie = function (name, value, options) {
905
905
*/
906
906
907
907
res . location = function location ( url ) {
908
- var loc = String ( url ) ;
908
+ var loc ;
909
909
910
910
// "back" is an alias for the referrer
911
911
if ( url === 'back' ) {
912
912
loc = this . req . get ( 'Referrer' ) || '/' ;
913
+ } else {
914
+ loc = String ( url ) ;
913
915
}
914
916
915
- var lowerLoc = loc . toLowerCase ( ) ;
916
- var encodedUrl = encodeUrl ( loc ) ;
917
- if ( lowerLoc . indexOf ( 'https://' ) === 0 || lowerLoc . indexOf ( 'http://' ) === 0 ) {
918
- try {
919
- var parsedUrl = urlParse ( loc ) ;
920
- var parsedEncodedUrl = urlParse ( encodedUrl ) ;
921
- // Because this can encode the host, check that we did not change the host
922
- if ( parsedUrl . host !== parsedEncodedUrl . host ) {
923
- // If the host changes after encodeUrl, return the original url
924
- return this . set ( 'Location' , loc ) ;
925
- }
926
- } catch ( e ) {
927
- // If parse fails, return the original url
928
- return this . set ( 'Location' , loc ) ;
929
- }
930
- }
917
+ var m = schemaAndHostRegExp . exec ( loc ) ;
918
+ var pos = m ? m [ 0 ] . length + 1 : 0 ;
919
+
920
+ // Only encode after host to avoid invalid encoding which can introduce
921
+ // vulnerabilities (e.g. `\\` to `%5C`).
922
+ loc = loc . slice ( 0 , pos ) + encodeUrl ( loc . slice ( pos ) ) ;
931
923
932
- // set location
933
- return this . set ( 'Location' , encodedUrl ) ;
924
+ return this . set ( 'Location' , loc ) ;
934
925
} ;
935
926
936
927
/**
0 commit comments