src: avoid dereference without existence check
Currently the URL API is only used from the JS binding, which always initializes base
regardless of has_base
. Therefore, there is no actual security risk right now, but there would be had we made other C++ parts of Node.js use this API.
Because of that, I was not able to add any JS tests, instead resorting to C++. However, the magic of C++ compilers makes a reliable test impossible, as the added test only sometimes fails before this PR, even though when it does fail it is a NULL pointer dereference.
Refs: https://github.com/nodejs/node/pull/14369#discussion_r128767221
Checklist
-
make -j4 test
(UNIX), orvcbuild test
(Windows) passes -
tests and/or benchmarks are included -
commit message follows commit guidelines
Affected core subsystem(s)
url