Comments (2)
The issue comes from the remove dot segments step. Let's consider the URI m:/.//
. Then, according to the RFC:
B. if the input buffer begins with a prefix of "/./" […], then replace that prefix with "/"
So it should be normalized to m://
, but this has different semantics (resulting in \
being interpreted as being part of the authority in the original example).
I have conducted a few tests with some URI normalization libraries:
$ node test.js
http://example.com/a/c/d
m:/.//
$ cat test.php
<?php
require_once 'URLNormalizer.php';
echo (new Normalizer('http://example.com/a/b/../c/d'))->normalize(), "\n";
echo (new Normalizer('m:/.//'))->normalize(), "\n";
?>
$ php test.php
http://example.com/a/c/d
m:/
$ cat test.pl
use feature qw(say);
use URI::Normalize qw(normalize_uri);
say normalize_uri(URI->new('http://example.com/a/b/../c/d'));
say normalize_uri(URI->new('m:/.//'));
$ perl test.pl
http://example.com/a/c/d
m://
$ cat test.rb
require 'addressable/uri'
p Addressable::URI.parse('http://example.com/a/b/../c/d').normalize.to_s
p Addressable::URI.parse('m:/.//').normalize.to_s
$ ruby test.rb
"http://example.com/a/c/d"
/usr/share/rubygems-integration/all/gems/addressable-2.8.1/lib/addressable/uri.rb:2487:in `validate': Cannot have a path with two leading slashes without an authority set: 'm://' (Addressable::URI::InvalidURIError)
from /usr/share/rubygems-integration/all/gems/addressable-2.8.1/lib/addressable/uri.rb:2410:in `defer_validation'
from /usr/share/rubygems-integration/all/gems/addressable-2.8.1/lib/addressable/uri.rb:839:in `initialize'
from /usr/share/rubygems-integration/all/gems/addressable-2.8.1/lib/addressable/uri.rb:2184:in `new'
from /usr/share/rubygems-integration/all/gems/addressable-2.8.1/lib/addressable/uri.rb:2184:in `normalize'
from test.rb:3:in `<main>'
For PHP, I am using https://github.com/glenscott/url-normalizer. In short:
- Node does not remove the dot before a double-slash; I think the logic is somewhere in there, but I never liked browsing Firefox's source code, so who knows?
- PHP removes the dot but avoids leaving a double-slash where it would be reinterpreted as the authority; this is done by merging consecutive slashes, which is does not conform to the RFC
- Perl exhibits the same bug as
rust-url
- Ruby straight up refuses to parse a path with two leading slashes without an authority
I feel like Ruby's is the most consistent and straightforward solution.
This does mean that the no_panic
test from #654 must be amended. However, we can cover the m:/.//
case in a dedicated unit test.
See #817
from rust-url.
The offending URL can be reduced to m:/.//\\
.
from rust-url.
Related Issues (20)
- Release new version of `data-url` HOT 1
- idna::punycode::encode_str() wrong conversion ? HOT 2
- Add parameter spaceAsPlus to ByteSerialize
- Incorrect parsing of Windows drive letter quirk
- Invalid IPv4 but parsing success HOT 1
- URL http:www.google.com is passed as validated HOT 1
- Host should implement deserialize to parse strings
- JOIN functionality not working HOT 4
- URL validity change between 2.2 and 2.3. HOT 2
- Documentation for IDNA configuration options should explain use cases
- Feature request: add parser boolean option to leave relative paths in the URL.
- Neither punycode::encode_str nor Config::...::to_ascii return expected results for single Unicode char and "EXAMPLE" HOT 3
- `Url::from_file_path()` incorrect handling of backslash on linux
- `=` is not being escaped as query value HOT 2
- [DataUrl] Unable to parse application/json;utf8 containing # HOT 1
- Feature request: provide separate struct for URL which is can-be-base
- Error: 🚫 Building project failed: error[E0583]: file not found for module `origin`serde, interproc... HOT 2
- Poping a path segment removes slash separator HOT 2
- No hostname format validation in URL HOT 5
- The input urls generated by the fuzzer can be problematic as it causes very long parse times
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from rust-url.