Re: [whatwg/url] IPv4 host parser + site definition seems potentially dangerous. (#560)

@MattMenke2 currently the host parser is never invoked with the empty string (note the assert in step 4) and I'm pretty sure that therefore the IPv4 parser isn't either. But also, if it was the empty string, why would it not return that and return 0 instead? (Note that the number parser empty string case can only be reached due to input starting with 0x, 0X, or 0.)

I don't think your suggestion works as we run the IPv4 parser on all domains. Your change would make all domains return failure basically.

The minimum change is probably that whenever we return _input_ now from the IPv4 parser, we first check if _input_'s last label can be parsed as a number (using the IPv4 number parser or something more strict that doesn't do 0x/0X/0 prefixes, though presumably larger than 255 would still be failure) and if so, we return failure instead.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/url/issues/560#issuecomment-736428722