fix(isURL): evaluate host whitelist against the actual host of bracketed URLs

[koding88]

Summary

The early host_whitelist branch checked host, which is the empty string whenever the URL target is a bracket-wrapped host like http://[::1] — the real address lives in the ipv6 variable at that point. Two observable defects:

Input	Options	Expected	Actual (before)
http://[::1]	host_whitelist: ['::1']	true	false
http://[::1]:8080	host_whitelist: ['::1']	true	false
http://[2001:db8::1]/	host_whitelist: [/^2001:/]	true	false
http://[not-an-ip]	host_whitelist: [/^$/]	false	true

So whitelisted bracketed IPv6 hosts were always rejected, and a whitelist entry matching the empty string accepted arbitrary bracketed hosts without any IP validation.

Fix

Resolve the effective host before the check:

return checkHost(host || ipv6, options.host_whitelist);

Plain-domain behavior — including the legacy early-return semantics that let users allowlist non-FQDN hosts such as localhost — is unchanged.

Tests

Two regression tests in test/validators.test.js:

• whitelist evaluated against bracketed IPv6 hosts (exact string and regex entries, with and without port)
• an empty-matching whitelist regex must not accept bracketed garbage hosts

Both fail on master and pass with this change. Full suite: 325 passing, ESLint clean, line coverage unchanged at 100%.

Checklist

• PR contains only changes related to this bug; no stray files
• README not affected (documents no change in option contract)
• Tests written

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (a79ff98) to head (445ea01).

Additional details and impacted files

@@            Coverage Diff            @@
##            master     #2866   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files          114       114           
  Lines         2599      2599           
  Branches       658       659    +1     
=========================================
  Hits          2599      2599           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

This PR fixes isURL’s host_whitelist handling for bracketed IPv6 URLs (e.g. http://[::1]) by ensuring the whitelist is checked against the actual host value (ipv6) rather than the empty host string produced by the bracketed-host parsing path.

Changes:

• Update src/lib/isURL.js to evaluate host_whitelist against host || ipv6 so bracketed IPv6 hosts are correctly allowlisted and empty-string whitelist matches no longer “accidentally” allow bracketed garbage.
• Add regression tests covering allowlisted bracketed IPv6 hosts (string + regex entries, with/without port).
• Add regression test ensuring an empty-matching whitelist regex does not accept non-IP bracketed hosts.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/lib/isURL.js	Uses `host
test/validators.test.js	Adds focused regression tests for bracketed IPv6 whitelist behavior and the empty-string whitelist edge case.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.