Forcibly escape username/pass for basic auth URLs too

Author: geelen

src/lib/utils.test.ts

@@ -84,6 +84,11 @@ describe('sanitizeUrl', () => {
       const result = sanitizeUrl('https://example.com?empty&hasvalue=test')
       expect(result).toBe('https://example.com/?empty&hasvalue=test')
     })
+
+    it('should encode basic auth', () => {
+      const result = sanitizeUrl('http://user$(calc)r:pass$(calc)[email protected]')
+      expect(result).toBe('http://user%24(calc)r:pass%24(calc)[email protected]/')
+    })
   })
 
   describe('should handle complex URLs', () => {

src/lib/utils.ts

@@ -722,6 +722,8 @@ export function sanitizeUrl(raw: string) {
   if (url.hostname !== encodeURIComponent(url.hostname)) abort()
 
   // Forcibly sanitise all the pieces of the URL
+  if (url.username) url.username = encodeURIComponent(url.username)
+  if (url.password) url.password = encodeURIComponent(url.password)
   url.pathname = url.pathname.slice(0, 1) + encodeURIComponent(url.pathname.slice(1)).replace(/%2f/ig,'/')
   url.search = url.search.slice(0, 1) + Array.from(url.searchParams.entries()).map(sanitizeParam).join('&')
   url.hash = url.hash.slice(0, 1) + encodeURIComponent(url.hash.slice(1))