Re: [whatwg/fetch] Block requests for suspected dangling markup. (#519)

mikewest commented on this pull request.



> @@ -2408,6 +2408,10 @@ with a <i>CORS flag</i> and <i>recursive flag</i>, run these steps:
  not <a lt="is local">local</a>, set
  <var>response</var> to a <a>network error</a>.
 
+ <li><p>If |request|'s <a for=request>url</a>'s <a for=url>parser-removed-tab-or-newline flag</a>
+ is set, and |request|'s <a for=request>url</a> <a for=url>path</a> contains a U+003C
+ code point ("<code>&lt;</code>"), then set <var>response</var> to a <a>network error</a>.

Ugh. Right. Would you prefer that I:

1. Add a "this is potentially dangling markup" flag to URL that is set during parsing (which might help with the explanation here)?
2. Walk through the items in `path` looking for characters?
3. Serialize the URL and walk through that?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/519#discussion_r108418426