url: reject special-scheme hosts made only of IDNA-ignored code points

src/jsc/bindings/DOMURL.cpp

@@ -150,6 +150,9 @@ static String applyIDNADeltaToURLAuthority(const String& urlString, StringView s
         return {};
 
     auto mappedHost = Bun::applyUnicode16IDNADelta(hostView.toString());
+    // All-ignored host: splicing "" in would reparse http://\u180E/a as http:///a (host "a"); skip so the parser rejects it.
+    if (mappedHost.isEmpty())
+        return {};
     StringBuilder builder;
     builder.append(view.left(hostStart));
     builder.append(mappedHost);

src/jsc/bindings/URLDecomposition.cpp

@@ -113,6 +113,18 @@ static unsigned countASCIIDigits(StringView string)
     return length;
 }
 
+// The WHATWG host/hostname states stop consuming at the first of these; the
+// IDNA delta must not touch anything at or past it (see DOMURL.cpp).
+static size_t findHostTerminator(StringView value)
+{
+    for (size_t i = 0; i < value.length(); i++) {
+        char16_t c = value[i];
+        if (c == '/' || c == '\\' || c == '?' || c == '#')
+            return i;
+    }
+    return value.length();
+}
+
 void URLDecomposition::setHost(StringView value)
 {
     auto fullURL = this->fullURL();
@@ -121,11 +133,16 @@ void URLDecomposition::setHost(StringView value)
     // Non-special schemes and '['-prefixed (IPv6) hosts never run IDNA.
     String mappedValue;
     if (fullURL.hasSpecialScheme() && !value.startsWith('[')) {
-        size_t hostEnd = value.reverseFind(':');
-        auto hostSpan = hostEnd == notFound ? value : value.left(hostEnd);
+        size_t terminator = findHostTerminator(value);
+        size_t hostEnd = value.left(terminator).reverseFind(':');
+        size_t hostSpanEnd = hostEnd == notFound ? terminator : hostEnd;
+        auto hostSpan = value.left(hostSpanEnd);
         if (Bun::containsUnicode16IDNADeltaSource(hostSpan)) {
             auto mappedHost = Bun::applyUnicode16IDNADelta(hostSpan.toString());
-            mappedValue = hostEnd == notFound ? mappedHost : makeString(mappedHost, value.substring(hostEnd));
+            // A host mapping to empty is a failed host parse, not an assignable literal "".
+            if (mappedHost.isEmpty())
+                return;
+            mappedValue = makeString(mappedHost, value.substring(hostSpanEnd));
             value = mappedValue;
         }
     }
@@ -173,9 +190,17 @@ void URLDecomposition::setHostname(StringView host)
     // See setHost: the input is a hostname by definition, and only special
     // schemes run IDNA on it.
     String mappedHost;
-    if (fullURL.hasSpecialScheme() && !host.startsWith('[') && Bun::containsUnicode16IDNADeltaSource(host)) {
-        mappedHost = Bun::applyUnicode16IDNADelta(host.toString());
-        host = mappedHost;
+    if (fullURL.hasSpecialScheme() && !host.startsWith('[')) {
+        size_t terminator = findHostTerminator(host);
+        auto hostSpan = host.left(terminator);
+        if (Bun::containsUnicode16IDNADeltaSource(hostSpan)) {
+            auto mappedSpan = Bun::applyUnicode16IDNADelta(hostSpan.toString());
+            // See setHost: mapping a non-empty hostname to empty is failure, not "".
+            if (mappedSpan.isEmpty())
+                return;
+            mappedHost = makeString(mappedSpan, host.substring(terminator));
+            host = mappedHost;
+        }
     }
     if (host.isEmpty() && !fullURL.protocolIsFile() && fullURL.hasSpecialScheme())
         return;

test/js/web/url/url.test.ts

@@ -161,6 +161,58 @@ describe("url", () => {
     expect(h2.host).toBe("xn--foo-7ka:81");
   });
 
+  it("rejects special-scheme hosts made only of IDNA-ignored code points", () => {
+    // U+180E and U+206A..U+206F map to nothing under UTS #46, so these hosts
+    // map to the empty string: domain-to-ASCII failure (node throws
+    // ERR_INVALID_URL), never "promote the first path segment to the host".
+    const inputs = [
+      "http://\u180E/evil.example/x",
+      "https://\u206A\u206F/other.example/p",
+      "ws://\u180E/h/p",
+      "file://\u180E/some/dir/f",
+      "http://\u180E\u206B:8080/x",
+      "http://user@\u180E/x",
+    ];
+    const errInvalidURL = expect.objectContaining({ code: "ERR_INVALID_URL" });
+    for (const input of inputs) {
+      expect(() => new URL(input)).toThrow(errInvalidURL);
+      expect(URL.canParse(input)).toBe(false);
+      expect(URL.parse(input)).toBeNull();
+      const u = new URL("http://ok.example/");
+      expect(() => (u.href = input)).toThrow(errInvalidURL);
+    }
+    // Scheme-relative input and an all-ignored base reach the same host span.
+    expect(() => new URL("//\u180E/evil.example/", "http://good.example/")).toThrow(errInvalidURL);
+    expect(URL.canParse("//\u180E/evil.example/", "http://good.example/")).toBe(false);
+    expect(() => new URL("/x", "http://\u206A/base.example/")).toThrow(errInvalidURL);
+    // Mixed hosts still strip the ignored code point rather than failing.
+    expect(new URL("http://a\u180Eb/").href).toBe("http://ab/");
+    expect(new URL("file://a\u180Eb/x").host).toBe("ab");
+    // Setters: a non-empty host that maps to empty is a failed host parse and
+    // no-ops, even for file: where assigning a literal "" clears the host.
+    const f1 = new URL("file://server/share");
+    f1.host = "\u180E";
+    expect(f1.href).toBe("file://server/share");
+    const f2 = new URL("file://server/share");
+    f2.hostname = "\u180E";
+    expect(f2.href).toBe("file://server/share");
+    const f3 = new URL("file://server/share");
+    f3.host = "";
+    expect(f3.href).toBe("file:///share");
+    // A terminator after the ignored code points must not smuggle the tail
+    // past the empty-host guard: the host span ends at the first / \ ? #.
+    for (const tail of ["/x", "\\x", "?x", "#x"]) {
+      for (const base of ["file://server/share", "http://ok.example/p"]) {
+        const withHost = new URL(base);
+        withHost.host = "\u180E" + tail;
+        expect(withHost.href).toBe(base);
+        const withHostname = new URL(base);
+        withHostname.hostname = "\u180E" + tail;
+        expect(withHostname.href).toBe(base);
+      }
+    }
+  });
+
   it("prints", () => {
     // URL.prototype carries [Symbol.for("nodejs.util.inspect.custom")], so
     // Bun.inspect matches node's util.inspect output.