Allow arbitrary schemes & username/password in "new URL()" parser (#37597)

GitOrigin-RevId: 00504773f3efd91efc7989a83b60b4f145108884

Author: goffrie

crates/isolate/src/ops/http.rs

@@ -241,35 +241,26 @@ struct UrlInfo {
     href: String,
     pathname: String,
     port: String,
-    protocol: String,
     search: String,
+    username: String,
+    password: String,
 }
 
 impl TryFrom<Url> for UrlInfo {
     type Error = anyhow::Error;
 
     fn try_from(value: Url) -> Result<Self, Self::Error> {
-        if value.username() != "" || value.password().is_some() {
-            anyhow::bail!("Unsupported URL with username and password")
-        }
-
-        if value.scheme() != "http" && value.scheme() != "https" {
-            anyhow::bail!(
-                "Unsupported URL scheme -- http and https are supported (scheme was {})",
-                value.scheme()
-            )
-        }
-
         let url_info = UrlInfo {
-            scheme: value[Position::BeforeScheme..Position::AfterScheme].to_string(),
+            scheme: value.scheme().to_string(),
             hash: value[Position::BeforeFragment..Position::AfterFragment].to_string(),
             host: value[Position::BeforeHost..Position::BeforePath].to_string(),
             hostname: value[Position::BeforeHost..Position::AfterHost].to_string(),
             href: value.to_string(),
             pathname: value[Position::BeforePath..Position::AfterPath].to_string(),
             port: value[Position::BeforePort..Position::AfterPort].to_string(),
-            protocol: value[..Position::AfterScheme].to_string(),
             search: value[Position::BeforeQuery..Position::AfterQuery].to_string(),
+            username: value.username().to_owned(),
+            password: value.password().unwrap_or_default().to_owned(),
         };
         Ok(url_info)
     }

crates/isolate/src/tests/js_builtins.rs

@@ -21,33 +21,6 @@ async fn test_url(rt: TestRuntime) -> anyhow::Result<()> {
         must_let!(let ConvexValue::String(r) = t.query("js_builtins/url", assert_obj!()).await?);
         assert_eq!(String::from(r), "success".to_string());
 
-        assert_contains(
-            &t.query_js_error("js_builtins/url:passwordNotImplemented", assert_obj!())
-                .await?,
-            "Not implemented: get password",
-        );
-
-        assert_contains(
-            &t.query_js_error("js_builtins/url:usernameNotImplemented", assert_obj!())
-                .await?,
-            "Not implemented: get username",
-        );
-
-        assert_contains(
-            &t.query_js_error(
-                "js_builtins/url:unsupportUrlUsernameAndPassword",
-                assert_obj!(),
-            )
-            .await?,
-            "Unsupported URL with username and password",
-        );
-
-        assert_contains(
-            &t.query_js_error("js_builtins/url:unsupportedUrlProtocol", assert_obj!())
-                .await?,
-            "Unsupported URL scheme",
-        );
-
         assert_contains(
             &t.query_js_error("js_builtins/url:setHostUnimplemented", assert_obj!())
                 .await?,

npm-packages/udf-runtime/src/00_url.ts

@@ -165,9 +165,10 @@ type UrlInfo = {
   hostname: string;
   pathname: string;
   port: string;
-  protocol: string;
   search: string;
   href: string;
+  username: string;
+  password: string;
 };
 
 type URLInfoResult =
@@ -259,11 +260,20 @@ class URL {
   }
 
   get origin() {
-    return `${this.protocol}//${this.host}`;
+    switch (this._urlInfo.scheme) {
+      case "ftp":
+      case "http":
+      case "https":
+      case "ws":
+      case "wss":
+        return `${this._urlInfo.scheme}://${this.host}`;
+      default:
+        return "null";
+    }
   }
 
   get password() {
-    return throwNotImplementedMethodError("get password", "URL");
+    return this._urlInfo.password;
   }
 
   set password(_password: string) {
@@ -293,7 +303,7 @@ class URL {
   }
 
   get protocol() {
-    return this._urlInfo.protocol.toString() + ":";
+    return this._urlInfo.scheme.toString() + ":";
   }
 
   set protocol(_protocol: string) {
@@ -323,7 +333,7 @@ class URL {
   }
 
   get username() {
-    return throwNotImplementedMethodError("get username", "URL");
+    return this._urlInfo.username;
   }
 
   set username(_username: string) {
@@ -357,6 +367,8 @@ class URL {
       href: this.href,
       origin: this.origin,
       protocol: this.protocol,
+      username: this.username,
+      password: this.password,
       host: this.host,
       hostname: this.hostname,
       port: this.port,

npm-packages/udf-runtime/src/23_request.ts

@@ -58,6 +58,17 @@ export interface RequestInit {
 
 const _contentLength = Symbol("[[contentLength]]");
 
+const validateURL = (s: string | URL) => {
+  const url = new URL(s);
+  const protocol = url.protocol;
+  if (protocol !== "http:" && protocol !== "https:") {
+    throw new TypeError(
+      `Unsupported URL scheme -- http and https are supported (scheme was ${protocol.slice(0, protocol.length - 1)})`,
+    );
+  }
+  return url.href;
+};
+
 export class Request {
   private readonly _headers: Headers;
   private readonly _url: string;
@@ -76,7 +87,7 @@ export class Request {
     this._signal = new AbortSignal();
     if (input instanceof Request) {
       // Copy initial values from the request. Options can still override them.
-      this._url = new URL(input.url).href;
+      this._url = validateURL(input.url);
       this._method = input.method;
       this._headers = new Headers(input.headers);
       this._signal = input.signal;
@@ -85,7 +96,7 @@ export class Request {
       // * If this object has a Request.mode of navigate, the mode value is converted to same-origin.
     } else if (input instanceof URL || typeof input === "string") {
       const href = input instanceof URL ? input.href : input;
-      this._url = new URL(href).href;
+      this._url = validateURL(href);
       // Use default values.
       this._method = "GET";
       this._headers = new Headers([]);

npm-packages/udf-tests/convex/adversarial.ts

@@ -347,7 +347,7 @@ export const useNotImplementedBuiltin = query(async () => {
   try {
     const url = new URL("https://baz.qat:8000/qux/quux?foo=bar&baz=12#qat");
     // This should throw an uncatchable "Not implemented" error
-    url.password;
+    url.password = "foo";
   } catch (e) {
     return "Caught an error!";
   }