- From: The Moisrex <notifications@github.com>
- Date: Sun, 05 Oct 2025 08:37:56 -0700
- To: whatwg/url <url@noreply.github.com>
- Cc: Subscribed <subscribed@noreply.github.com>
Received on Sunday, 5 October 2025 15:38:00 UTC
the-moisrex left a comment (whatwg/url#883) And under no circumstances (I mean it, it's a big security issue most-likely) write a custom parser for user-inputted URLs that first is not going through a WHATWG-compliant URL parser first. Meaning, don't do raw split's and what not on raw strings. Remember, `https://123/`'s hostname is not `123`, it's `0.0.0.123`. Make sure your URL has gone through a URL parser at least once during its lifetime, or you completely trust the place where the URL is being generated. -- Reply to this email directly or view it on GitHub: https://github.com/whatwg/url/issues/883#issuecomment-3369137446 You are receiving this because you are subscribed to this thread. Message ID: <whatwg/url/issues/883/3369137446@github.com>
Received on Sunday, 5 October 2025 15:38:00 UTC