Re: [whatwg/url] A '@' character in the host part of file URLs (Issue #805)

A single `@` in the authority section (username, password, hostname, port) generally delimits the credentials from the hostname.

Let's take any other URL scheme, e.g. HTTP: `http://webdavserver.net@ssl/`
- "webdavserver.net" would be the _username_
- "ssl" would be the hostname

Which is clearly not what the reporter wants to happen.

What's more, this has been the accepted interpretation for at least the last 30 years (going back to RFC-1738). I doubt that any URL parser anywhere is going to interpret `file://webdavserver.net@ssl/` as having a hostname containing an `@` sign, so we must keep the `@` escaped. `file://webdavserver.net%40ssl/` is semantically correct.

I think the actual problem is that hostnames in file URLs are not able to contain percent-encoding. I looked in to this in depth a while back, and found that:

- UNC server names can contain spaces, which obviously must be escaped. Chromium even has test cases for this (see linked issue below), so you'll probably hit this sooner or later.
- Windows allows pre-canonicalised paths, which are expressed using UNC syntax with the hostname "?" (e.g. `\\?\C\SomePath`). These cannot be expressed using file URLs because the hostname would have to be `%3F`.

See https://github.com/whatwg/url/issues/599

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/url/issues/805#issuecomment-1841147008
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/url/issues/805/1841147008@github.com>