Repository navigation
perf: validate absolute URLs without throwing - #460
Merged
Merged
Conversation
Collaborator
Author
|
Cc @mcollina |
gurgunday
force-pushed
the
perf/bad-absolute-url-no-stack
branch
2 times, most recently
from
October 6, 2026 21:01
34f444c to
81bf387
Compare
mcollina
requested changes
Oct 7, 2026
mcollina
left a comment
Collaborator
There was a problem hiding this comment.
can you rewrite the tests to not have inlined JS as string? Store those in a fixtures folder
getPathFromAbsoluteUrl() validated absolute URLs with new URL(), which throws on malformed input. The error was always caught and discarded, so allocating it and capturing its stack trace was wasted work on an attacker-controlled path. Use URL.parse(), which returns null instead of throwing. It is only available since Node.js 20.18.0, so fall back to URL.canParse() followed by new URL() on older versions. Routing a malformed absolute URL goes from ~2150ns to ~100ns (-95%), with no measurable change for valid absolute or relative requests. Signed-off-by: Gürgün Dayıoğlu <hey@gurgun.day>
Signed-off-by: Gürgün Dayıoğlu <hey@gurgun.day>
gurgunday
force-pushed
the
perf/bad-absolute-url-no-stack
branch
from
October 8, 2026 11:48
81bf387 to
f969947
Compare
Collaborator
Author
@mcollina no idea how it slipped in 😄, fixed we don't need inline, probably the agent had an issue and cheated |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
getPathFromAbsoluteUrl() validates absolute URLs with new URL(), which throws on malformed input. The error is always caught and discarded
use URL.parse instead
as we support node 20, we have to check the existence of the function