Re: [whatwg/url] Malformed URL Normalization in Standard Introduces SSRF Risks (Issue #893)

the-moisrex left a comment (whatwg/url#893)

Yes, I'm aware of that. And that is the point. Any modification to the href should make the string **Not Normalized**.

And using the term **invalid** for `http:127.1` is not exactly correct either. We could consider them as non-failure errors, but not errors. 

Ada-url for example simply ignores these non-failure errors AFIK. In my implementation which is a work in progress, I have them as warning flags.

`special-scheme-missing-following-solidus` non-failure validation error is only about `file:` scheme not having slashes, not other special schemes; maybe there's something there!

<img width="870" height="794" alt="Image" src="https://github.com/user-attachments/assets/0b7cd515-ca6b-4c9b-9a81-82384bc7d00e" />

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/url/issues/893#issuecomment-3707795630
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/url/issues/893/3707795630@github.com>