Add patch to sanitize paths and hosts before parsing (Closes: #906058, CVE-2018-3774)

debian/patches/CVE-2018-3774.patch

+Description: Fix for CVE-2018-3774
+Author: Arnout Kazemier <https://github.com/3rd-Eden/>
+Origin: upstream, https://github.com/unshiftio/url-parse/commit/53b1794e
+Bug: https://security-tracker.debian.org/tracker/CVE-2018-3774
+Bug-Debian: https://bugs.debian.org/906058
+Forwarded: not-needed
+Reviewed-By: Xavier Guimard <yadd@debian.org>
+Last-Update: 2019-06-11
+
+--- a/index.js
++++ b/index.js
+@@ -20,6 +20,9 @@
+ var instructions = [
+   ['#', 'hash'],                        // Extract from the back.
+   ['?', 'query'],                       // Extract from the back.
++  function sanitize(address) {          // Sanitize what is left of the address
++    return address.replace('\\', '/');
++  },
+   ['//', 'protocol', 2, 1, 1],          // Extract from the front.
+   ['/', 'pathname'],                    // Extract from the back.
+   ['@', 'auth', 1],                     // Extract from the front.
+@@ -74,6 +77,10 @@
+ 
+   for (; i < instructions.length; i++) {
+     instruction = instructions[i];
++    if (typeof instruction === 'function') {
++      address = instruction(address);
++      continue;
++    }
+     parse = instruction[0];
+     key = instruction[1];
+ 
+--- a/test.js
++++ b/test.js
+@@ -152,6 +152,28 @@
+     assume(parsed.pathname).equals('/b/c');
+   });
+ 
++  it('ignores \\ in pathnames', function () {
++    var url = 'http://google.com:80\\@yahoo.com/#what\\is going on'
++      , parsed = parse(url);
++
++    assume(parsed.port).equals('');
++    assume(parsed.username).equals('');
++    assume(parsed.password).equals('');
++    assume(parsed.hostname).equals('google.com');
++    assume(parsed.hash).equals('#what\\is going on');
++
++    parsed = parse('//\\what-is-up.com');
++    assume(parsed.pathname).equals('/what-is-up.com');
++  });
++
++  it('correctly ignores multiple slashes //', function () {
++    var url = '////what-is-up.com'
++      , parsed = parse(url);
++
++    assume(parsed.host).equals('');
++    assume(parsed.hostname).equals('');
++  });
++
+   describe('ip', function () {
+     // coap://
+     //
+@@ -386,6 +408,15 @@
+ 
+       assume(data.href).equals('https://google.com/?foo=bar');
+     });
++
++    it('maintains the port number for non-default port numbers', function () {
++      var parsed = parse('http://google.com:8080/pathname');
++
++      assume(parsed.set('host', 'google.com:8080')).equals(parsed);
++
++      assume(parsed.host).equals('google.com:8080');
++      assume(parsed.href).equals('http://google.com:8080/pathname');
++    });
+   });
+ 
+   describe('fuzzy', function () {

debian/patches/series

+CVE-2018-3774.patch