Re: [whatwg/url] javascript: URL parsing (#307)

Instead of "uncomfortable" how about "semantically meaningless"?

IIUC, `javascript://` is a script containing a single comment. Setting `username` on it then modifies that comment to have an extra string at the beginning? It appears to be a harmless but nonsensical operation. But if there turned out to be a scenario in which it actually had some functional impact I would regret it. To me it looks like a security hole waiting for somebody to come along and find a way to exploit it.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/url/issues/307#issuecomment-1333084117
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/url/issues/307/1333084117@github.com>