- From: Domenic Denicola <notifications@github.com>
- Date: Wed, 01 Jul 2026 19:57:29 -0700
- To: whatwg/url <url@noreply.github.com>
- Cc: Subscribed <subscribed@noreply.github.com>
Received on Thursday, 2 July 2026 02:57:33 UTC
domenic left a comment (whatwg/url#704) I unleashed both Codex and Claude (Fable 5!) on what remains after #924, and they wrote very exhaustive-seeming fuzzers. [Claude wrote a long-winded writeup](https://gist.github.com/domenic/c2285ead47ddd80e1f5ae98062e41e57), but the summary is that they were only able to identify one remaining gap: special-scheme URLs where ToASCII turns the host into an IPv4 address. E.g., `ws://0.0.0.0`, `https://1。2。3。4`, `https://².2.3.4`, `https://①.2.3.4`, or inserting various normalized-away characters like zero-width space or the BOM. I'm somewhat hopeful that after this we'd actually be done. But, I've thought that before... -- Reply to this email directly or view it on GitHub: https://github.com/whatwg/url/issues/704#issuecomment-4861768293 You are receiving this because you are subscribed to this thread. Message ID: <whatwg/url/issues/704/4861768293@github.com>
Received on Thursday, 2 July 2026 02:57:33 UTC