A URL-related security threat is that it is sometimes possible to construct a URL such that an attempt to perform a harmless idempotent operation such as the retrieval of the object will in fact cause a possibly damaging remote operation to occur. The unsafe URL is typically constructed by specifying a port number other than that reserved for the network protocol in question. The client unwittingly contacts a server which is in fact running a different protocol. The content of the URL contains instructions which when interpreted according to this other protocol cause an unexpected operation. (An example has been the use of gopher URLs to cause a rude message to be sent via a SMTP server). It is potentially harmful for client software use any URL which specifies a port number other than the default for the protocol, especially when it is a number within the reserved space.
Care should be taken when URLs contain embedded encoded delimiters for a given protocol (for example, CR and LF characters for telnet protocols) that these are not unencoded before transmission. This misimplementation of the specification would could violate the protocol but could without violating the protocol be used to simulate an extra operation or parameter, again causing an unexpected and possible harmful remote operation to be performed.
The use of URLs containing passwords is clearly unwise.