Re: [whatwg/url] Malformed URL Normalization in Standard Introduces SSRF Risks (Issue #893)

annevk left a comment (whatwg/url#893)

@the-moisrex I don't think you have sufficiently explained either why we need to make a distinction between those inputs.

I'll note that `http://///////////////////////////////////////127.0.0.1` will log a validation error in parsers that log those. It appears it logs an incorrect name and we should address that, but those names are not really material.

So either you reject input that ends up logging validation errors or you pass a serialized version of the URL onward to the next part of the system (this is what browsers typically do which is why you won't see `/../` in an HTTP request originating from a browser for instance), but none of that requires any changes and is already possible with what is standardized today.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/url/issues/893#issuecomment-3709385246
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/url/issues/893/3709385246@github.com>