Re: [whatwg/url] Basic URL parse requires stripping tabs before host state is entered, allowing bad hosts (Issue #829)

Glad you see the inconsistency I'm describing (or at least see this dual interpretation of the URL components as not ideal). 

I also can see where this requirement originally came from - the RFC 3986 does describe that URLs embedded in plain text may contain whitespace (e.g. [RFC 3986, Appendix C](https://datatracker.ietf.org/doc/html/rfc3986#appendix-C)):

> In some cases, extra whitespace (spaces, line-breaks, tabs, etc.) may
   have to be added to break a long URI across lines.  The whitespace
   should be ignored when the URI is extracted.

However, they do qualify later that this is required for user-types URLs:

> For robustness, software that accepts user-typed URI should attempt
   to recognize and strip both delimiters and embedded whitespace.

Perhaps a non-normative note can be added to this spec to describe that whitespace stripping is intended for contexts where user input is expected and otherwise it should not be stripped, which would conform to RFC 3986 in terms of individual URI component grammar.

Without this clarification even today browsers are not consistent in how this rule is interpreted. Take this example:
```html
<p>Link with tabs: <a target="_blank" href="https://www.&#0009;github&#0009;.com/&#0009;?abc&#0009;xyz=12&#0009;34">ABC</a></p>
<p>Link with spaces: <a target="_blank" href="https://www. github .com/ ?abc xyz=12 34">ABC</a></p>
<p>Link without spaces: <a target="_blank" href="https://www.github.com/?abcxyz=1234">ABC</a></p>
```
Firefox and Chrome will strip tabs, but will leave spaces and Firefox won't do anything with this link and Chrome will replace spaces with `%20` and will open that bogus URL.

HTML anchors are not user-typed input and a non-normative note like this would allow implementers to take URL context into consideration when parsing URLs.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/url/issues/829#issuecomment-2289609042
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/url/issues/829/2289609042@github.com>