Explicit early out for invalid URLs

lib/cors-anywhere.js

@@ -231,6 +231,10 @@ function parseURL(req_url) {
     return null;
   }
   if (!match[1]) {
+    if (/^https?:/i.test(req_url)) {
+      // The pattern at top could mistakenly parse "http:///" as host="http:" and path=///.
+      return null;
+    }
     // Scheme is omitted.
     if (req_url.lastIndexOf('//', 0) === -1) {
       // "//" is omitted.
@@ -238,7 +242,12 @@ function parseURL(req_url) {
     }
     req_url = (match[4] === '443' ? 'https:' : 'http:') + req_url;
   }
-  return url.parse(req_url);
+  var parsed = url.parse(req_url);
+  if (!parsed.hostname) {
+    // "http://:1/" and "http:/notenoughslashes" could end up here.
+    return null;
+  }
+  return parsed;
 }
 
 // Request handler factory

test/test.js

@@ -119,6 +119,31 @@ describe('Basic functionality', function() {
       .expect(200, helpText, done);
   });
 
+  it('GET /http://:1234', function(done) {
+    // 'http://:1234' is an invalid URL.
+    request(cors_anywhere)
+      .get('/http://:1234')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expect(200, helpText, done);
+  });
+
+  it('GET /http:///', function(done) {
+    // 'http://:1234' is an invalid URL.
+    request(cors_anywhere)
+      .get('/http:///')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expect(200, helpText, done);
+  });
+
+  it('GET /http:/notenoughslashes', function(done) {
+    // 'http:/notenoughslashes' is an invalid URL.
+    request(cors_anywhere)
+      .get('/http:/notenoughslashes')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expect(200, helpText, done);
+  });
+
+
   it('GET ///example.com', function(done) {
     // API base URL (with trailing slash) + '//example.com'
     request(cors_anywhere)