4 ms·
As another example of an egregious difference that might bite you, compare this JS in recent Node vs web browsers: new URL('postgres://user:pass@host/db')
by gmac 3y ago
As another example of an egregious difference that might bite you, compare this JS in recent Node vs web browsers:
new URL('postgres://user:pass@host/db')
Node parses this as if it were a web address, into protocol, username, password, host, pathname, etc.
Browsers just parse out the protocol and call everything else a pathname.
- btilly 3y agoBrowsers do that for a good reason. They used to do the protocol, username, password, host, pathname, etc. But scammers used it to have a user name that looked like a well-known URL, while actually directing the user to a domain under the scammer's control. Not honoring the spec was therefore a security feature.
- cma 3y agoWhy not just delete the url bar contents after attempting that url or something? Or take to a warning page.
- btilly 3y agoAny such decision requires no longer honoring https://www.rfc-editor.org/rfc/rfc1738 https://www.rfc-editor.org/rfc/rfc1738.
- cxr 3y agoPlease be more specific.
- btilly 3y agoSection 3.1 specifies /<user>:<password>@<host>:<port>/<url-path> Which means if you're presented with that and don't send it to that host, you've violated the RFC. But this was demonstrably resulting in confused users being sent to scammer's domains.
- cxr 3y agoThat ("if you're presented with that and don't send it to that host, you've violated the RFC") has nothing to do with the comment you responded to, which described a UI choice compatible with RFC 3986, which says "Applications should not render as clear text any data after the first colon (":") character found within a userinfo subcomponent" (and which also goes on to say "Applications may choose to ignore or reject such data when it is received as part of a reference").
- silverwind 3y ago`URL` in node and browser is supposed to be compatible, this looks like a bug (browser ignoring protocols they don't know).
- cxr 3y agoURL parsing semantics are defined by and dependent upon the scheme. (That's spec.) By definition, if you don't recognize the scheme, you cannot guarantee a correctly parsed URL. From RFC 1738: The Internet Assigned Numbers Authority (IANA) will maintain a registry of URL schemes. Any submission of a new URL scheme must include a definition of an algorithm for accessing of resources within that scheme and the syntax for representing such a scheme. The behavior described (extracting the scheme and treating the rest as an opaque string) is pretty much the only thing you can do when the scheme is unrecognized. (The other options being to throw an exception or return null.) Based on the description, it sounds like neither are breaking spec—it's just that Node supports "postgres". That is, unless it's true that Node's URL implementation is supposed to match what browsers do, in which case Node is breaking spec—its own.
- bkallus 3y agoRFC 3986 provides a generic URI grammar that is not scheme-specific, though other standards that define URL schemes may choose to subset the subset that grammar as they see fit. If a URL parser does not recognize a scheme, I would expect it to parse the URL using the generic parsing procedure.
- cxr 3y agoWell, they don't. Browsers implement the WHATWG's spec, which says not to do that and was created to supersede RFC 3986.