Re: [whatwg/url] Basic URL parse requires stripping tabs before host state is entered, allowing bad hosts (Issue #829)

For posterity:
```console
$ curl -I https://run.mocky.io/v3/abe4108f-192b-46a4-a6aa-7902802a7c1d
HTTP/1.1 302 Found
Location: https://exa mple.com/
Content-Type: text/plain; charset=UTF-8
Date: Fri, 16 Aug 2024 18:45:27 GMT
Content-Length: 0
Sozu-Id: 01J5E84HM63HESNCPC8E4M9STR
```
The `Location` header field value (_which is specified by [RFC 9110](https://www.rfc-editor.org/rfc/rfc9110.html#field.location) to be an [RFC 3986 URI-reference](https://www.rfc-editor.org/rfc/rfc3986.html#section-4.1)_) contains a tab character in the middle of the "example" label of host "example.com", making it invalid (i.e., not a URI-reference). Firefox and Safari therefore reject the response as invalid and display a local error page, while Chrome interprets it as a redirect to https://example.com (_presumably applying the tab-stripping https://url.spec.whatwg.org/#concept-basic-url-parser algorithm of this spec_).

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/url/issues/829#issuecomment-2293998480
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/url/issues/829/2293998480@github.com>