url: treat \ the same as /

See https://code.google.com/p/chromium/issues/detail?id=25916

Parse URLs with backslashes the same as web browsers, by replacing all
backslashes with forward slashes, except those that occur after the
first # character.

2 files changed, 32 insertions, 0 deletions

diff --git a/lib/url.js b/lib/url.js
index 09e9cceb42..c13f74b5dd 100644
--- a/lib/url.js
+++ b/lib/url.js
@@ -107,6 +107,12 @@ Url.prototype.parse = function(url, parseQueryString, slashesDenoteHost) {
     throw new TypeError("Parameter 'url' must be a string, not " + typeof url);
   }
 
+  // Copy chrome, IE, opera backslash-handling behavior.
+  // See: https://code.google.com/p/chromium/issues/detail?id=25916
+  var hashSplit = url.split('#');
+  hashSplit[0] = hashSplit[0].replace(/\\/g, '/');
+  url = hashSplit.join('#');
+
   var rest = url;
 
   // trim before proceeding.
diff --git a/test/simple/test-url.js b/test/simple/test-url.js
index 57d0a6d5a6..95f50a23c3 100644
--- a/test/simple/test-url.js
+++ b/test/simple/test-url.js
@@ -34,6 +34,28 @@ var parseTests = {
     'path': '//some_path'
   },
 
+  'http:\\\\evil-phisher\\foo.html#h\\a\\s\\h': {
+    protocol: 'http:',
+    slashes: true,
+    host: 'evil-phisher',
+    hostname: 'evil-phisher',
+    pathname: '/foo.html',
+    path: '/foo.html',
+    hash: '#h\\a\\s\\h',
+    href: 'http://evil-phisher/foo.html#h\\a\\s\\h'
+  },
+
+
+  'http:\\\\evil-phisher\\foo.html': {
+    protocol: 'http:',
+    slashes: true,
+    host: 'evil-phisher',
+    hostname: 'evil-phisher',
+    pathname: '/foo.html',
+    path: '/foo.html',
+    href: 'http://evil-phisher/foo.html'
+  },
+
   'HTTP://www.example.com/' : {
     'href': 'http://www.example.com/',
     'protocol': 'http:',
@@ -1457,3 +1479,7 @@ relativeTests2.forEach(function(relativeTest) {
                'format(' + relativeTest[1] + ') == ' + expected +
                '\nactual:' + actual);
 });
+
+// backslashes should be like forward slashes
+var res = url.resolve('http://example.com/x', '\\\\foo.com\\bar');
+assert.equal(res, 'http://foo.com/bar');