Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
doc: correct unsafe URL example in http docs
The previous documentation example for converting `request.url` to an `URL` object was unsafe, as it could allow a server crash through malformed URL inputs and potentially enable host header attacks. This commit revises the example to use string concatenation over the usage of the `baseUrl` and removes the usage of the `req.headers.host` as the authority part of the url, mitigating both the crash and security risks by ensuring the host part of the URL remains controlled and predictable. Fixes nodejs#52494 Co-authored-by: @astlouisf Co-authored-by: @samhh
- Loading branch information