Re: [whatwg/url] Are drive letters always invalid? (#612)

> I'm not sure if that is correct. Of the 4 kinds of paths Windows supports (yes, really), one of them is DOS device paths, for example: `\\.\C:\Windows\`. Since it has the same format as a UNC path, I wouldn't be surprised if some systems turned that in to `file://./C:/Windows/` (i.e. a hostname which is a single dot).

On further investigation, it appears that, while DOS device paths _can_ semantically contain drive letters, they are not considered the path root when they are in such paths. That's what [Microsoft's documentation](https://docs.microsoft.com/en-us/dotnet/standard/io/file-path-formats#evaluate-relative-components) says, and indeed, using the Windows API function `GetFullPathName` to normalize `\\.\C:\foo\bar\..\..\..\..\..` returns `\\.\`

Buuuuut, since we're talking about file paths, of course the situation is actually more complex than that. If the file URL has a hostname, and that hostname is not `.` or `?` (and it won't be the latter, because we don't support that), then the URL represents a UNC path. That means - regardless of whether it looks like a drive letter - we should consider the first component the path root, since it is the UNC share. You shouldn't be able to pop the UNC share with `..` in the same way you can't pop the drive letter. Normalizing `\\server\share\foo\..\..\..\..\..\..` via the same Windows API returns `\\server\share`.

So basically: for most hostnames, we should be preserving the share name, which is semantically not a drive letter (i.e. shouldn't be normalized). Today, we only have that behaviour for some share names, and we do it for the wrong reason (because we think they're drive letters), and we normalize them when really we shouldn't.

As far as I can tell, neither Edge/Chrome nor IE actually handle UNC path roots correctly (`file://127.0.0.1/SomeShare/somedir/../../../` won't be found, even though `file://127.0.0.1/SomeShare/` works), so I'd predict that using a `file:` URL to follow relative links on a static HTML page accessed via UNC might also not be very robust.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/url/issues/612#issuecomment-872346996