fix: reject punycode hosts with non-public ASCII TLDs

[cursor]

Bug and impact

When the hostname contains a punycode (xn--) label, url-http disables url-regex-safe's public TLD list (tlds: []). That lets IDN hosts with non-public ASCII suffixes pass validation while the equivalent ASCII hosts are rejected.

Concrete triggers that previously returned the href instead of false:

• https://example.local/ → false (correct)
• https://xn--e1afmkfd.local/ → accepted (incorrect)
• https://пример.local/ → accepted (incorrect; normalizes to the punycode form above)
• https://xn--80a0aaa.internal/ → accepted (incorrect)
• https://xn--80a0aaa.invalidtld/ → accepted (incorrect)

Callers that treat a truthy result as a validated public HTTP(S) URL can accept private/special-use or garbage suffixes via an IDN label — an SSRF-adjacent validation bypass.

This is distinct from #30 (credentialed-URL bypass) and #31 (path-substring authority bypass).

Root cause

Punycode matching uses tlds: [] so IDN TLDs like xn--p1ai still match (the default list has no xn-- entries). An empty TLD alternation effectively skips public-suffix validation for any host that merely contains a punycode label.

Fix

After a successful punycode match, require the hostname's final label to either:

1. be an IDN TLD (xn--*), or
2. pass an exact url-regex-safe check with the default public TLD list (via origin + '/')

Valid cases such as https://xn--80a0aaa.com/ and https://example.xn--p1ai/ still accept.

Validation

• Added regression cases for .local / .internal / arbitrary suffix punycode hosts
• npm test passes (lint + Ava, 100% coverage)

  

---

Note

Medium Risk
Changes URL validation behavior for IDN/punycode hosts (SSRF-adjacent); intended to tighten acceptance but could affect edge-case URLs that previously passed.

Overview
Fixes a validation bypass where any hostname containing an xn-- label used tlds: [], so url-regex-safe skipped public-suffix checks and accepted IDN hosts on .local, .internal, or fake suffixes while the ASCII equivalents were rejected.

TLD handling now derives the last label only: custom tlds is passed when that label is an IDN TLD (xn--*), otherwise the default public TLD list applies. Punycode in non-TLD labels no longer disables suffix validation. The punycode-regex dependency is removed; IPv6 still uses non-exact matching only.

Regression tests cover punycode/Unicode hosts on private and invalid suffixes.

^{Reviewed by Cursor Bugbot for commit 802d669. Bugbot is set up for automated code reviews on this repo. Configure here.}