23009 2013-08-19 16:11:58 +0000 Unicode normalization can produce / code points in domain names 2014-01-14 11:19:59 +0000 1 1 1 Unclassified WHATWG URL unspecified PC All RESOLVED FIXED P2 normal Unsorted 1 annevk annevk mathias mike poccil sideshowbarker+urlspec oldest_to_newest 92273 0 annevk 2013-08-19 16:11:58 +0000 E.g. "℁" (U+2101) gives "a/s". Which means "http://ex℁ample℁" becomes "http://exa/sample/" except the host is "exa/sample" rather than "exa"... We should probably fail host parsing if the output gives any label that contains "/" as a code point. Presumably by further overriding the IDNA2003 ToASCII algorithm. Other code points that would change re-parsing and would need to be added: ":", "\", "?", "#". Source: http://krijnhoetmer.nl/irc-logs/whatwg/20130815#l-327 92344 1 poccil 2013-08-20 15:44:04 +0000 There is no need to "override" the algorithm; IDNA2003 already includes a flag for that purpose: "UseSTD3ASCIIRules"; see section 4 of RFC3490. 92348 2 annevk 2013-08-20 16:28:16 +0000 It does, but that excludes way more code points than implementations do and is not compatible with the web. E.g. _ (U+005F) must not be excluded. 98417 3 annevk 2014-01-14 11:19:59 +0000 https://github.com/whatwg/url/commit/81cdd6704ea695e1619e76794227d2c9d10d2aa7 https://github.com/whatwg/url/commit/0eaf28c5ae63b5b0487cce484f3ce201e0d98494