{"action":"created","issue":{"url":"https://api.github.com/repos/unshiftio/url-parse/issues/29","repository_url":"https://api.github.com/repos/unshiftio/url-parse","labels_url":"https://api.github.com/repos/unshiftio/url-parse/issues/29/labels{/name}","comments_url":"https://api.github.com/repos/unshiftio/url-parse/issues/29/comments","events_url":"https://api.github.com/repos/unshiftio/url-parse/issues/29/events","html_url":"https://github.com/unshiftio/url-parse/issues/29","id":149874690,"number":29,"title":"Carefully crafted url can give the wrong hostname","user":{"login":"holm","id":467209,"avatar_url":"https://avatars.githubusercontent.com/u/467209?v=3","gravatar_id":"","url":"https://api.github.com/users/holm","html_url":"https://github.com/holm","followers_url":"https://api.github.com/users/holm/followers","following_url":"https://api.github.com/users/holm/following{/other_user}","gists_url":"https://api.github.com/users/holm/gists{/gist_id}","starred_url":"https://api.github.com/users/holm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/holm/subscriptions","organizations_url":"https://api.github.com/users/holm/orgs","repos_url":"https://api.github.com/users/holm/repos","events_url":"https://api.github.com/users/holm/events{/privacy}","received_events_url":"https://api.github.com/users/holm/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":10,"created_at":"2016-04-20T20:20:22Z","updated_at":"2016-04-21T08:41:36Z","closed_at":"2016-04-21T07:55:05Z","body":"This was reported to us by a security researcher.\r\n\r\n```js\r\nconst URL = require('url-parse');\r\n\r\nconst url = new URL('http://attacker.com\\@google.com');\r\n\r\nconsole.log(url.hostname);\r\n```\r\n\r\nThis will output `google.com`, however if you open the url in Chrome it will end up on `attacker.com`.\r\n"},"comment":{"url":"https://api.github.com/repos/unshiftio/url-parse/issues/comments/212813004","html_url":"https://github.com/unshiftio/url-parse/issues/29#issuecomment-212813004","issue_url":"https://api.github.com/repos/unshiftio/url-parse/issues/29","id":212813004,"user":{"login":"holm","id":467209,"avatar_url":"https://avatars.githubusercontent.com/u/467209?v=3","gravatar_id":"","url":"https://api.github.com/users/holm","html_url":"https://github.com/holm","followers_url":"https://api.github.com/users/holm/followers","following_url":"https://api.github.com/users/holm/following{/other_user}","gists_url":"https://api.github.com/users/holm/gists{/gist_id}","starred_url":"https://api.github.com/users/holm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/holm/subscriptions","organizations_url":"https://api.github.com/users/holm/orgs","repos_url":"https://api.github.com/users/holm/repos","events_url":"https://api.github.com/users/holm/events{/privacy}","received_events_url":"https://api.github.com/users/holm/received_events","type":"User","site_admin":false},"created_at":"2016-04-21T08:41:36Z","updated_at":"2016-04-21T08:41:36Z","body":"Filed a Chromium issue, hopefully that should bring some clarity: https://bugs.chromium.org/p/chromium/issues/detail?id=605452"}}