From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on dcvr.yhbt.net X-Spam-Level: X-Spam-Status: No, score=-4.1 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_PASS,UNPARSEABLE_RELAY shortcircuit=no autolearn=ham autolearn_force=no version=3.4.2 Received: from neon.ruby-lang.org (neon.ruby-lang.org [221.186.184.75]) by dcvr.yhbt.net (Postfix) with ESMTP id 008561F5AE for ; Mon, 13 Jul 2020 21:02:01 +0000 (UTC) Received: from neon.ruby-lang.org (localhost [IPv6:::1]) by neon.ruby-lang.org (Postfix) with ESMTP id A766E120A0E; Tue, 14 Jul 2020 06:01:27 +0900 (JST) Received: from o1678948x4.outbound-mail.sendgrid.net (o1678948x4.outbound-mail.sendgrid.net [167.89.48.4]) by neon.ruby-lang.org (Postfix) with ESMTPS id 49E3B120A0D for ; Tue, 14 Jul 2020 06:01:25 +0900 (JST) Received: by filterdrecv-p3mdw1-75c584b9c6-q6br2 with SMTP id filterdrecv-p3mdw1-75c584b9c6-q6br2-18-5F0CCBBF-8F 2020-07-13 21:01:51.49679384 +0000 UTC m=+1482736.492076482 Received: from herokuapp.com (unknown) by ismtpd0098p1mdw1.sendgrid.net (SG) with ESMTP id 5RmVVxerRXKM0mFqhP5wuQ for ; Mon, 13 Jul 2020 21:01:51.353 +0000 (UTC) Date: Mon, 13 Jul 2020 21:01:51 +0000 (UTC) From: matthew@kerwin.net.au Message-ID: References: Mime-Version: 1.0 X-Redmine-MailingListIntegration-Message-Ids: 74948 X-Redmine-Project: ruby-master X-Redmine-Issue-Tracker: Bug X-Redmine-Issue-Id: 17029 X-Redmine-Issue-Author: nileshtr X-Redmine-Sender: phluid61 X-Mailer: Redmine X-Redmine-Host: bugs.ruby-lang.org X-Redmine-Site: Ruby Issue Tracking System X-Auto-Response-Suppress: All Auto-Submitted: auto-generated X-SG-EID: =?us-ascii?Q?dc6bl8=2FRfjZl6IUFmz6hrXGqzg+6U4v9dH0u7=2FcQTE9EMRQoH=2Foq6USVp4AGXQ?= =?us-ascii?Q?NsZc=2FvFYQam5fHWAX7bFENWQferh4bkwLt+NGGm?= =?us-ascii?Q?D9+AQXY0j6X8qWMZQoydUM75Lpj8+U8Hie9Gtj7?= =?us-ascii?Q?XB12svkgXnYdpFpfgMzuLiayxIbe0uhTU4MeAMh?= =?us-ascii?Q?hhiy13ft8tsxUzbLpOKuAkyy9Bx1ZPEBvHmaOnc?= =?us-ascii?Q?bJtNVgNrBR7BjpvoQ=3D?= To: ruby-core@ruby-lang.org X-ML-Name: ruby-core X-Mail-Count: 99158 Subject: [ruby-core:99158] [Ruby master Bug#17029] URI.parse considers https://example.com/### invalid when browsers consider it valid X-BeenThere: ruby-core@ruby-lang.org X-Mailman-Version: 2.1.15 Precedence: list Reply-To: Ruby developers List-Id: Ruby developers List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ruby-core-bounces@ruby-lang.org Sender: "ruby-core" Issue #17029 has been updated by phluid61 (Matthew Kerwin). It's not valid according to RFC 3986 (the URI standard) but that is pretty old now. I suspect switching from the IETF URI spec to the WHATWG URL spec would have other consequences, too. ---------------------------------------- Bug #17029: URI.parse considers https://example.com/### invalid when browsers consider it valid https://bugs.ruby-lang.org/issues/17029#change-86536 * Author: nileshtr (Nilesh Trivedi) * Status: Open * Priority: Normal * ruby -v: ruby 2.7.1p83 (2020-03-31 revision a0c7c23c9c) [x86_64-darwin19] * Backport: 2.5: UNKNOWN, 2.6: UNKNOWN, 2.7: UNKNOWN ---------------------------------------- I have a form with `` and in the backend, I try to extract the domain with `URI.parse(url).host` A user was able to submit a value like `https://example.com/###` which passed the browser's validation check, but failed by `URI.parse` with this error: ``` 3: from /Users/helix/.rbenv/versions/2.7.1/lib/ruby/2.7.0/uri/common.rb:234:in `parse' 2: from /Users/helix/.rbenv/versions/2.7.1/lib/ruby/2.7.0/uri/rfc3986_parser.rb:73:in `parse' 1: from /Users/helix/.rbenv/versions/2.7.1/lib/ruby/2.7.0/uri/rfc3986_parser.rb:67:in `split' URI::InvalidURIError (bad URI(is not URI?): "https://example.com/###") ``` You can try the browser's behavior at MDN's demo: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input/url This is what the MDN page says about validation: The syntax of a URL is fairly intricate. It's defined by WHATWG's URL Living Standard ( https://url.spec.whatwg.org/ ) and is described for newcomers in our article What is a URL? ( https://developer.mozilla.org/en-US/docs/Learn/Common_questions/What_is_a_URL ) -- https://bugs.ruby-lang.org/