url: drop auth in url.resolve() if host changes

Fixes: #1435
PR-URL: #1480
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Brian White <[email protected]>

Author: rlidwka

lib/url.js

@@ -754,6 +754,7 @@ Url.prototype.resolveObject = function(relative) {
     if (relative.protocol) {
       relative.hostname = null;
       relative.port = null;
+      result.auth = null;
       if (relative.host) {
         if (relPath[0] === '') relPath[0] = relative.host;
         else relPath.unshift(relative.host);
@@ -765,10 +766,14 @@ Url.prototype.resolveObject = function(relative) {
 
   if (isRelAbs) {
     // it's absolute.
-    result.host = (relative.host || relative.host === '') ?
-                  relative.host : result.host;
-    result.hostname = (relative.hostname || relative.hostname === '') ?
-                      relative.hostname : result.hostname;
+    if (relative.host || relative.host === '') {
+      result.host = relative.host;
+      result.auth = null;
+    }
+    if (relative.hostname || relative.hostname === '') {
+      result.hostname = relative.hostname;
+      result.auth = null;
+    }
     result.search = relative.search;
     result.query = relative.query;
     srcPath = relPath;

test/parallel/test-url.js

@@ -1538,7 +1538,21 @@ var relativeTests2 = [
   //changeing auth
   ['http://diff:[email protected]',
    'http://asdf:[email protected]',
-   'http://diff:[email protected]/']
+   'http://diff:[email protected]/'],
+
+  // https://github.com/nodejs/node/issues/1435
+  ['https://another.host.com/',
+   'https://user:[email protected]/',
+   'https://another.host.com/'],
+  ['//another.host.com/',
+   'https://user:[email protected]/',
+   'https://another.host.com/'],
+  ['http://another.host.com/',
+   'https://user:[email protected]/',
+   'http://another.host.com/'],
+  ['mailto:another.host.com',
+   'mailto:[email protected]',
+   'mailto:another.host.com'],
 ];
 relativeTests2.forEach(function(relativeTest) {
   const a = url.resolve(relativeTest[1], relativeTest[0]);