Re: [whatwg/url] Basic URL parse requires stripping tabs before host state is entered, allowing bad hosts (Issue #829)

> This requirement is not about user-typed URLs. Browser address bar behavior is not codified in standards, that's largely the realm of UI.

If you look at their example, it doesn't have much to do with browsers at all - it's human-typed URL in all contexts human, such as emails, text messages, etc. These are the only contexts where this type of whitespace removal makes any sense. In machine-consumed contexts, such as `href`, whitespace in domains and URLs has no meaningful use and only will serve as a source of complexities and vulnerabilities.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/url/issues/829#issuecomment-2292229411
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/url/issues/829/2292229411@github.com>