Reject userinfo and backslashes in a URL authority

parse_url took http://user@evil.com/ for the host "user@evil.com", where
parsers that honour userinfo, or read a backslash as '/', see evil.com.
userinfo is not supported, so reject both.

httplib.h

@@ -889,6 +889,12 @@ inline bool parse_url(const std::string &url, UrlComponents &uc) {
   auto has_authority = has_authority_prefix || (!url.empty() && url[0] != '/' &&
                                                 url[0] != '?' && url[0] != '#');
   if (has_authority) {
+    // userinfo is not supported, and a backslash that some parsers take for
+    // '/' would leave them seeing another host than this one.
+    if (url.find_first_of("@\\", pos) < url.find_first_of("/?#", pos)) {
+      return false;
+    }
+
     if (pos < url.size() && url[pos] == '[') {
       auto close = url.find(']', pos);
       if (close == std::string::npos) { return false; }

test/test.cc

@@ -19498,11 +19498,14 @@ TEST(ParseUrlTest, FragmentHandling) {
 }
 
 TEST(ParseUrlTest, UserinfoHandling) {
-  // Userinfo with @ but no colon — host includes @
+  // userinfo is not supported. Parsers that honour it, or take a backslash for
-  detail::UrlComponents uc;
+  // '/', would see evil.com where the host used to be the whole authority.
-  ASSERT_TRUE(detail::parse_url("http://user@host.com/path", uc));
+  const char *urls[] = {"http://user@evil.com/", "http://user:pass@evil.com/",
-  EXPECT_EQ("user@host.com", uc.host);
+                        "http://evil.com\\@good.com/", "//user@evil.com/x"};
-  EXPECT_EQ("/path", uc.path);
+  for (auto url : urls) {
+    detail::UrlComponents uc;
+    EXPECT_FALSE(detail::parse_url(url, uc)) << url;
+  }
 }
 
 TEST(ParseUrlTest, IPv6EdgeCases) {