I checked the code. It seems like we have to modify the logic in line: 96

Lines 90 to 99 in f67a57f

    
           split = url.split('@'); 
        
           if (split.length > 1) { 
        
             if (options.disallow_auth) { 
        
               return false; 
        
             } 
        
             auth = split.shift(); 
        
             if (auth.indexOf(':') >= 0 && auth.split(':').length > 2) { 
        
               return false; 
        
             } 
        
           }

The implementation fails to check if the url is in basic auth form without password, that looks like this:

http://user:@www.foobar.com/

For the fix, we just have to check if it's in the right form.

   if (auth.indexOf(':') === -1 || (auth.indexOf(':') >= 0 && auth.split(':').length > 2)) { 
     return false; 
   }

This way, mymail@123.com will pass the condition and return false.

I'll submit a PR if you guys agree with the change. Thanks!

	split = url.split('@');
	if (split.length > 1) {
	if (options.disallow_auth) {
	return false;
	}
	auth = split.shift();
	if (auth.indexOf(':') >= 0 && auth.split(':').length > 2) {
	return false;
	}
	}

Uh oh!

isURL validates true to 'myemail@mail.com' #1375

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions