Re: [whatwg/url] Unicode normalization could change the structure of a URL (#626)

So OAuth2 accepts a URL string with Unicode in it and then:

1. Parses that URL string into a URL for its own purposes. (And it might terminate here if the URL is not adequate for some reason.)
2. Sends back that URL string for another consumer, but now NFKC/D normalized?

How is that not a bug in OAuth2?

You cannot apply Unicode normalization to all inputs, certainly not URL strings. They should only go into the URL parser.

I could see trying to disallow `＃` and similar code points, but pipelines that do this kind of (bogus) normalization on URL strings would still be susceptible to attacks, depending on when they perform the (bogus) normalization.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/url/issues/626#issuecomment-892707809