Ignore valid URLs inside JWTs

library/helpers/extractStringsFromUserInput.test.ts

@@ -232,3 +232,81 @@ t.test("it handles deeply nested JWT without stack overflow", async () => {
   t.ok(result.size > 0);
   t.ok(result.has("Test'), ('Test2');--"));
 });
+
+t.test("it ignores URLs in JWT payload", async () => {
+  const payloadObj = {
+    sub: "1234567890",
+    name: "John Doe",
+    service: "https://example.com",
+    test: "xyz",
+    iat: 1516239022,
+  };
+  const payload = Buffer.from(JSON.stringify(payloadObj)).toString("base64");
+  const jwt = `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.${payload}.1234567890`;
+
+  const input = {
+    token: jwt,
+    name: "Test'), ('Test2');--",
+  };
+
+  t.same(
+    extractStringsFromUserInput(input),
+    fromArr([
+      "token",
+      jwt,
+      "name",
+      "Test'), ('Test2');--",
+      "sub",
+      "1234567890",
+      "John Doe",
+      "service",
+      "test",
+      "xyz",
+      "iat",
+    ])
+  );
+});
+
+t.test("it does not ignore invalid URLs in JWT payload", async () => {
+  const payloadObj = {
+    sub: "1234567890",
+    name: "John Doe",
+    service: "https://example .com/invalid",
+    iat: 1516239022,
+  };
+  const payload = Buffer.from(JSON.stringify(payloadObj)).toString("base64");
+  const jwt = `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.${payload}.1234567890`;
+
+  const input = {
+    token: jwt,
+    name: "Test'), ('Test2');--",
+  };
+
+  t.same(
+    extractStringsFromUserInput(input),
+    fromArr([
+      "token",
+      jwt,
+      "name",
+      "Test'), ('Test2');--",
+      "sub",
+      "1234567890",
+      "John Doe",
+      "service",
+      "https://example .com/invalid",
+      "iat",
+    ])
+  );
+});
+
+t.test("it does not ignore URLs outside of JWT payload", async () => {
+  const input = {
+    url: "https://example.com",
+    name: "Test'), ('Test2');--",
+  };
+
+  t.same(
+    extractStringsFromUserInput(input),
+    fromArr(["url", "https://example.com", "name", "Test'), ('Test2');--"])
+  );
+});

library/helpers/extractStringsFromUserInput.ts

@@ -1,6 +1,7 @@
 import { isPlainObject } from "./isPlainObject";
 import { safeDecodeURIComponent } from "./safeDecodeURIComponent";
 import { tryDecodeAsJWT } from "./tryDecodeAsJWT";
+import { tryParseURL } from "./tryParseURL";
 
 type UserString = string;
 
@@ -61,6 +62,11 @@ export function extractStringsFromUserInput(
         delete jwt.object.iss;
       }
       extractStringsFromUserInput(jwt.object, depth + 1).forEach((value) => {
+        if (value.startsWith("http") && tryParseURL(value)) {
+          // Do not add URLs as strings because they can contain domains and produce false positives
+          return;
+        }
+
         results.add(value);
       });
     }