From 9d4d73ffa9ac1b6d4fc288d09ddb9046630c1e40 Mon Sep 17 00:00:00 2001
From: Daijiro Wachi <daijiro.wachi@gmail.com>
Date: Fri, 17 Mar 2017 03:41:54 +0100
Subject: [PATCH] url: restrict setting protocol to "file"

Since file URLs can not have `username/password/port`,
the specification was updated to restrict setting protocol to "file".

Refs: https://github.com/whatwg/url/pull/269
Fixes: https://github.com/nodejs/node/issues/11785
---
 lib/internal/url.js | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/internal/url.js b/lib/internal/url.js
index 005f5b66476752..91b0640b50e8f6 100644
--- a/lib/internal/url.js
+++ b/lib/internal/url.js
@@ -133,6 +133,13 @@ function onParseProtocolComplete(flags, protocol, username, password,
   if ((s && !newIsSpecial) || (!s && newIsSpecial)) {
     return;
   }
+  if (protocol === 'file:' &&
+    (ctx.username || ctx.password || ctx.port !== undefined)) {
+    return;
+  }
+  if (ctx.scheme === 'file:' && !ctx.host) {
+    return;
+  }
   if (newIsSpecial) {
     ctx.flags |= binding.URL_FLAGS_SPECIAL;
   } else {