Reject protocol relative URLs unless the flag is set, fixes #860

CHANGELOG.md

@@ -8,6 +8,8 @@
   ([#848](https://github.com/chriso/validator.js/pull/848))
 - Added a `no_colons` option to `isMACAddress()`
   ([#849](https://github.com/chriso/validator.js/pull/849))
+- Updated `isURL()` to reject protocol relative URLs unless a flag is set
+  ([#860](https://github.com/chriso/validator.js/issues/860))
 - New and improved locales
   ([#801](https://github.com/chriso/validator.js/pull/801),
    [#856](https://github.com/chriso/validator.js/pull/856),

lib/isURL.js

@@ -82,7 +82,10 @@ function isURL(url, options) {
     }
   } else if (options.require_protocol) {
     return false;
-  } else if (options.allow_protocol_relative_urls && url.substr(0, 2) === '//') {
+  } else if (url.substr(0, 2) === '//') {
+    if (!options.allow_protocol_relative_urls) {
+      return false;
+    }
     split[0] = url.substr(2);
   }
   url = split.join('://');

src/lib/isURL.js

@@ -56,7 +56,10 @@ export default function isURL(url, options) {
     }
   } else if (options.require_protocol) {
     return false;
-  } else if (options.allow_protocol_relative_urls && url.substr(0, 2) === '//') {
+  } else if (url.substr(0, 2) === '//') {
+    if (!options.allow_protocol_relative_urls) {
+      return false;
+    }
     split[0] = url.substr(2);
   }
   url = split.join('://');

test/validators.js

@@ -302,6 +302,7 @@ describe('Validators', () => {
       ],
       invalid: [
         'http://localhost:3000/',
+        '//foobar.com',
         'xyz://foobar.com',
         'invalid/',
         'invalid.x',

validator.js

@@ -402,7 +402,10 @@ function isURL(url, options) {
     }
   } else if (options.require_protocol) {
     return false;
-  } else if (options.allow_protocol_relative_urls && url.substr(0, 2) === '//') {
+  } else if (url.substr(0, 2) === '//') {
+    if (!options.allow_protocol_relative_urls) {
+      return false;
+    }
     split[0] = url.substr(2);
   }
   url = split.join('://');