Re: [whatwg/url] Add more restrictions to the host parser (#159)

My analysis of Chrome discounted the fact that while Chrome throws for a lot more hosts, it also happily emits percent-encoded hosts sometimes. So `https://}x/` becomes `https://%7Dx/` and is not treated as an error.

If we wanted to make a change, I would remove the `+` from the earlier safelist (fails in stable Safari at least) which leaves us with the ASCII code points I am certain of we need to support.

Namely: a-Z, 0-9, `-`, `.`, and `_` (only `_` is not technically allowed in domain names, but is sometimes used in hostnames around the web and therefore browsers have to special case there HTTPS code around it).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/url/issues/159#issuecomment-270400298