postmanlabs/postman-url-encoder

Bundled punycode module is deprecated

djbrown opened this issue · 3 comments

djbrown commented

While reading the Postman JavaScript reference I discovered that Postman uses the deprecated punycode module.

https://nodejs.org/api/punycode.html:

The version of the punycode module bundled in Node.js is being deprecated. In a future major version of Node.js this module will be removed. Users currently depending on the punycode module should switch to using the userland-provided Punycode.js module instead. For punycode-based URL encoding, see url.domainToASCII or, more generally, the WHATWG URL API.

It doesn't seem to be too much effort to fix, yet it has to be done across multiple affected repositories:
https://github.com/search?q=org%3Apostmanlabs+punycode&type=Code

codenirvana commented

Yes punycode library is available in Postman's script (pre-request and test) execution sandbox however it's not used while sending user's request.

I hear your concern but there are two primary reasons to not remove this from the sandbox:

  1. It's added 5-6 years ago and removing this will break a lot of existing collections
  2. It's compatible with browserify, it works on the Postman web
djbrown commented

@codenirvana my suggestion was not to remove it, but to switch to the proper punycode module

codenirvana commented

@djbrown Got it but, domainToASCII method has native dependencies which will not work with Browserify.

The url library available in the sandbox (Browserify built-in) is https://github.com/defunctzombie/node-url.