Skip to content

fix: reject spoofed URL objects with non-string toString() result - #217

Merged
okuryu merged 1 commit into
mainfrom
fix/url-tostring-spoofing
Jun 17, 2026
Merged

fix: reject spoofed URL objects with non-string toString() result#217
okuryu merged 1 commit into
mainfrom
fix/url-tostring-spoofing

Conversation

@redonkulus

@redonkulus redonkulus commented Apr 24, 2026

Copy link
Copy Markdown
Collaborator

Validates that URL.toString() returns a primitive string before passing to serialize(), preventing code injection via Object.create(URL.prototype) spoofing. Adds a regression test covering the attack vector from PSECBUGS-108653.

I confirm that this contribution is made under the terms of the license found in the root directory of this repository's source tree and that I have the authority necessary to make this contribution on behalf of its copyright owner.

@redonkulus @claude
fix: reject spoofed URL objects with non-string toString() result
34d6238 
Validates that URL.toString() returns a primitive string before
passing to serialize(), preventing code injection via Object.create(URL.prototype)
spoofing. Adds a regression test covering the attack vector from PSECBUGS-108653.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@redonkulus
redonkulus requested a review from okuryu April 24, 2026 19:56
@okuryu

okuryu commented Apr 24, 2026

Copy link
Copy Markdown
Collaborator

GitHub Actions is currently failing—can you help me fix it? I sent an email to ospo@yahooinc.com last week, but I haven't heard back and I'm really stuck.

@redonkulus

redonkulus commented Apr 28, 2026

Copy link
Copy Markdown
Collaborator Author

I sent a message to the team that manages the GitHub account.

@redonkulus

redonkulus commented May 21, 2026

Copy link
Copy Markdown
Collaborator Author

I'm still waiting for the GitHub management team to re-enable the account; hopefully, soon.

@okuryu