Atom table exhaustion via unrecognized URL schemes in hackney

@@ -1,6 +1,6 @@
 -record(hackney_url, {
  transport        :: atom(),
- scheme           :: atom(),
+ scheme           :: atom() | binary(),
  netloc   = <<>>  :: binary(),
  raw_path         :: binary() | undefined,
  path = <<>>      :: binary() | undefined | nil,

@@ -64,8 +64,16 @@ parse_url(URL) ->
       case is_valid_scheme(Scheme) of
         true ->
           SchemeLower = hackney_bstr:to_lower(Scheme),
-          SchemeAtom = binary_to_atom(SchemeLower, utf8),
-          parse_url(Rest, #hackney_url{transport=undefined, scheme=SchemeAtom});
+          %% GHSA-9653: never mint a fresh atom for an attacker-supplied
+          %% scheme. `binary_to_existing_atom` only matches schemes that
+          %% have already been registered (i.e. ones the runtime, this
+          %% module, or the caller has explicitly seen). Anything else
+          %% stays as a binary; the dispatcher rejects it as
+          %% unsupported_scheme either way.
+          SchemeRef = try binary_to_existing_atom(SchemeLower, utf8)
+                      catch error:badarg -> SchemeLower
+                      end,
+          parse_url(Rest, #hackney_url{transport=undefined, scheme=SchemeRef});
         false ->
           %% Not a valid scheme, treat as path-like URL
           parse_url(URL, #hackney_url{transport=hackney_tcp, scheme=http})

@@ -592,3 +592,22 @@ unsupported_scheme_test_() ->
         ?assertEqual(Expected#hackney_url.transport, R#hackney_url.transport),
         ?assertEqual(Expected#hackney_url.scheme, R#hackney_url.scheme)
      end} || {V, Expected} <- Tests].
+
+%% GHSA-9653: parse_url must not mint a fresh atom for every attacker-supplied
+%% scheme. binary_to_existing_atom keeps the atom table bounded; unknown
+%% schemes are returned as the lowercased binary instead.
+parse_url_does_not_intern_attacker_schemes_test() ->
+    Before = erlang:system_info(atom_count),
+    Schemes = [iolist_to_binary(["zzghsa9653-", integer_to_list(I)])
+               || I <- lists:seq(1, 200)],
+    lists:foreach(
+      fun(S) ->
+              U = hackney_url:parse_url(<<S/binary, "://host/p">>),
+              Scheme = U#hackney_url.scheme,
+              ?assert(is_binary(Scheme) orelse is_atom(Scheme)),
+              ?assertEqual(undefined, U#hackney_url.transport)
+      end, Schemes),
+    Delta = erlang:system_info(atom_count) - Before,
+    %% Allow a small slack for any unrelated atoms minted during the loop;
+    %% a regression would mint ~200 (one per unique scheme).
+    ?assert(Delta < 20).