GHSA-cp4w-6x4w-v2h5 lambdaisland/uri `authority-regex` returns the wrong authority

• Maven lambdaisland:uri: < 1.14.120 → fixed in 1.14.120

Summary `authority-regex` allows an attacker to send malicious URLs to be parsed by the `lambdaisland/uri` and return the wrong authority. This issue is similar to CVE-2020-8910. Details https://github.com/lambdaisland/uri/blob/d3355fcd3e235238f4dcd37be97787a84e580072/src/lambdaisland/uri.cljc#L9 This regex doesn't handle the backslash (`\`) character in the username correctly, leading to a wrong output. Payload: `https://example.com\\@google.com` The returned host is `google.com`, but the correct host should be `example.com`. `urllib3` (Python) and `google-closure-library` (Javascript) return `example.com` as the host. Here the correct (or current) regex used by `google-closure-library`: https://github.com/google/closure-library/blob/0e567abedb058e9b194a40cfa3ad4c507653bccf/closure/goog/uri/utils.js#L189 PoC ``` (ns poc.core) (require '[lambdaisland.uri :refer (uri)]) (def myurl "https://example.com\\@google.com") (defn -main [] (println myurl) (println (:host (uri myurl))) ) ``` Impact The library returns the wrong authority, and it can be abused to bypass host restrictions. Reference WHATWG Living URL spec, section 4.4 URL Parsing, host state: https://url.spec.whatwg.org/#url-parsing