22092 2013-05-20 03:02:01 +0000 "append the result to url's password if url's pa..." 2014-01-14 13:17:01 +0000 1 1 1 Unclassified WHATWG URL unspecified PC All RESOLVED WORKSFORME P2 normal Unsorted 1 naruse annevk mike sideshowbarker+urlspec oldest_to_newest 87887 0 naruse 2013-05-20 03:02:01 +0000 http://url.spec.whatwg.org/#parsing If URL parser is run with input="http://foo:bar@exmple.com", base="about:blank" url=ParsedURL(input=http://aaa:bbb@example.org, base="about:blank"), its username will be "aaafoo", and its password will be "bbbbar". In authority state, following sentence should be inserted before "Set the @ flag.": Otherwise, set url's username to the empty string, and set url's password to null. 87889 1 annevk 2013-05-20 03:20:40 +0000 Wait, how would you get in that situation? 87893 2 naruse 2013-05-20 04:53:08 +0000 (In reply to comment #1) > Wait, how would you get in that situation? Only unit testing. 87894 3 annevk 2013-05-20 05:10:42 +0000 Okay, so I think the fix here would be to require an override state (which should probably be limited to those from the API) when you provide a parsed URL to the URL parser algorithm. Unless you mean your failure is reachable through JavaScript somehow. 87897 4 naruse 2013-05-20 06:03:53 +0000 Sure, you can mark this as INVALID. 87904 5 annevk 2013-05-20 07:42:04 +0000 Does this help: https://github.com/whatwg/url/commit/0e6b08b5458860364d0f3604ca8f7c1b9244c600 87908 6 naruse 2013-05-20 07:52:58 +0000 (In reply to comment #5) > Does this help: > > https://github.com/whatwg/url/commit/0e6b08b5458860364d0f3604ca8f7c1b9244c600 Oh, I see. Therefore the URL parser algorithm should have following at the first line: If url is given but state override is not given, parse error, terminate this algorithm. 87948 7 annevk 2013-05-21 03:33:31 +0000 Given that something like that is not valid, I'm not sure that's needed. Those arguments are specifically added for the API. If you use them in ways the API did not envision, you're in trouble :-) 87964 8 naruse 2013-05-21 08:17:58 +0000 Sure if it is such policy. 98421 9 annevk 2014-01-14 13:17:01 +0000 I think this is now sufficiently clear. http://url.spec.whatwg.org/#concept-url-parser