3 ms·
WHATWG rejects ".://", yeah? It's not the most readable spec, but there's a tester here: https://jsdom.github.io/whatwg-url/ https://jsdom.github.io/whatwg-url/
by bbayles 3y ago
WHATWG rejects ".://", yeah? It's not the most readable spec, but there's a tester here:
https://jsdom.github.io/whatwg-url/ https://jsdom.github.io/whatwg-url/
I recently published bindings for ada (an implementation of the WHATWG URL Spec) for Python with the hope of having something that follows a single standard.
- LegionMammal978 3y agoIndeed, ".://" is a hard error under the WHATWG URL spec. If the URL doesn't start with an ASCII alpha character, then the scheme start state transitions to the no scheme state [0]. In that state, if there's no base URL that the input is relative to, then parsing must fail [1]. However, "evil.com://good.com" is a valid URL string per WHATWG, since its state machine accepts "." within the scheme after the first codepoint. The resulting URL object has a scheme of "evil.com", a host of "good.com", an empty path, and a null port, query, and fragment. [0] https://url.spec.whatwg.org/#scheme-start-state https://url.spec.whatwg.org/#scheme-start-state [1] https://url.spec.whatwg.org/#no-scheme-state https://url.spec.whatwg.org/#no-scheme-state
- chrismorgan 3y agoIt’s not fair to call it a hard error: it’s only invalid as an absolute URL. As a relative URL, it’s fine, just like “example.com” is invalid as an absolute URL but valid as a relative URL.
- LegionMammal978 3y agoTrue; I neglected to mention relative URL parsing, mostly since most URL manipulation I've personally done has been with absolute URLs.