Skip to content

url: run setter steps after converting the value - #67382

Open
thekivashyn wants to merge 1 commit into
nodejs:mainfrom
thekivashyn:url-setter-conversion-order
Open

thekivashyn wants to merge 1 commit into
nodejs:mainfrom
thekivashyn:url-setter-conversion-order

Conversation

@thekivashyn

@thekivashyn thekivashyn commented Nov 10, 2026 •

Copy link
Copy Markdown

Web IDL converts the assigned value to a string before the setter steps run. The component setters read the URL's href first and only then converted the value, so a URL that the conversion itself changed, through a toString() that assigns to href, was overwritten with the state from before the conversion.

Keep a reference to the context, which leaves the receiver check ahead of the conversion, convert the value, and read the href last.

Tested on macOS arm64 with a build of main at b1cd451:

  • test/parallel/test-whatwg-url-custom-setters-conversion.js fails without the lib/internal/url.js change and passes with it.
  • tools/test.py "parallel/test-whatwg-url-*" "parallel/test-url-*" parallel/test-fs-whatwg-url wpt/test-url: 113 passed.
  • make lint-js: passed.
  • make -j10 test-only: 7621 passed, 3 failed. The three (test-cli-node-options, test-openssl-ca-options, test-tls-off-thread-cert-loading-disabled) fail because NODE_USE_SYSTEM_CA is set in my shell, and pass with it unset.

The patch and this description were written with the help of a coding agent. I ran the new test on my own build.

#66188 rewrites the same setters. I can rebase onto it if it lands first.

Fixes: #67345
Refs: #66188
Assisted-by: a coding agent

Web IDL converts the assigned value to a string before the setter
steps run. The component setters read the URL's href first and only
then converted the value, so a URL that the conversion itself changed,
through a `toString()` that assigns to `href`, was overwritten with
the state from before the conversion.

Keep a reference to the context, which leaves the receiver check
ahead of the conversion, convert the value, and read the href last.

Fixes: nodejs#67345
Assisted-by: a coding agent
Signed-off-by: thekivashyn <dev.tringuyen@gmail.com>
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/url

@nodejs-github-bot nodejs-github-bot added needs-ci PRs that need a full CI run. whatwg-url Issues and PRs related to the WHATWG URL implementation. labels Nov 10, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Welcome to Node.js, and thank you for your first contribution!

Before review, please take a moment to read:

Please make sure every commit is signed off. For a first pull request, GitHub Actions require collaborator approval and Jenkins CI must be started by a collaborator or triager, so an initial wait is normal.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

needs-ci PRs that need a full CI run. whatwg-url Issues and PRs related to the WHATWG URL implementation.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

url: setters overwrite URL changes made during value coercion

2 participants