Re: [whatwg/url] Malformed URL Normalization in Standard Introduces SSRF Risks (Issue #893)

swhiteman left a comment (whatwg/url#893)

> You can validate by simply doing something like this: `new URL(string).href == string`.

Hmm, not really. For one, the scheme and hostname are canonicalized to lowercase. 

```javascript
new URL("HTTPS://EXAMPLE.COM?a=b").href == "HTTPS://EXAMPLE.COM?a=b" // false
```


-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/url/issues/893#issuecomment-3707774803
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/url/issues/893/3707774803@github.com>