Function stripURLForReferrer

deps/undici/src/lib/web/fetch/util.js:524–556

* Certain portions of URLs must not be included when sending a URL as the * value of a `Referer` header: a URLs fragment, username, and password * components must be stripped from the URL before it’s sent out. This * algorithm accepts a origin-only flag, which defaults to false. If set to * true

(url, originOnly = false)

 * @param {boolean} [originOnly=false]
 */
function stripURLForReferrer (url, originOnly = false) {
  // 1. Assert: url is a URL.
  assert(webidl.is.URL(url))

  // Note: Create a new URL instance to avoid mutating the original URL.
  url = new URL(url)

  // 2. If url’s scheme is a local scheme, then return no referrer.
  if (urlIsLocal(url)) {
    return 'no-referrer'
  }

  // 3. Set url’s username to the empty string.
  url.username = ''

  // 4. Set url’s password to the empty string.
  url.password = ''

  // 5. Set url’s fragment to null.
  url.hash = ''

  // 6. If the origin-only flag is true, then:
  if (originOnly === true) {
    // 1. Set url’s path to « the empty string ».
    url.pathname = ''

    // 2. Set url’s query to null.
    url.search = ''
  }

  // 7. Return url.
  return url
}

const isPotentialleTrustworthyIPv4 = RegExp.prototype.test
  .bind(/^127\.(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]\d|\d)\.){2}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]\d|\d)$/)