This is an archived snapshot of W3C's public bugzilla bug tracker, decommissioned in April 2019. Please see the home page for more details.

Bug 22092 - "append the result to url's password if url's pa..."
Summary: "append the result to url's password if url's pa..."
Status: RESOLVED WORKSFORME
Alias: None
Product: WHATWG
Classification: Unclassified
Component: URL (show other bugs)
Version: unspecified
Hardware: PC All
: P2 normal
Target Milestone: Unsorted
Assignee: Anne
QA Contact: sideshowbarker+urlspec
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-05-20 03:02 UTC by NARUSE, Yui
Modified: 2014-01-14 13:17 UTC (History)
1 user (show)

See Also:

Attachments

Description NARUSE, Yui 2013-05-20 03:02:01 UTC 
http://url.spec.whatwg.org/#parsing

If URL parser is run with input="http://foo:bar@exmple.com", base="about:blank"  url=ParsedURL(input=http://aaa:bbb@example.org, base="about:blank"), its username will be "aaafoo", and its password will be "bbbbar".

In authority state, following sentence should be inserted before "Set the @ flag.":

  Otherwise, set url's username to the empty string, and set url's password to null.
Comment 1 Anne 2013-05-20 03:20:40 UTC 
Wait, how would you get in that situation?
Comment 2 NARUSE, Yui 2013-05-20 04:53:08 UTC 
(In reply to comment #1)
> Wait, how would you get in that situation?

Only unit testing.
Comment 3 Anne 2013-05-20 05:10:42 UTC 
Okay, so I think the fix here would be to require an override state (which should probably be limited to those from the API) when you provide a parsed URL to the URL parser algorithm.

Unless you mean your failure is reachable through JavaScript somehow.
Comment 4 NARUSE, Yui 2013-05-20 06:03:53 UTC 
Sure, you can mark this as INVALID.
Comment 6 NARUSE, Yui 2013-05-20 07:52:58 UTC 
(In reply to comment #5)
> Does this help:
> 
> https://github.com/whatwg/url/commit/0e6b08b5458860364d0f3604ca8f7c1b9244c600

Oh, I see.
Therefore the URL parser algorithm should have following at the first line:

  If url is given but state override is not given, parse error, terminate this algorithm.
Comment 7 Anne 2013-05-21 03:33:31 UTC 
Given that something like that is not valid, I'm not sure that's needed. Those arguments are specifically added for the API. If you use them in ways the API did not envision, you're in trouble :-)
Comment 8 NARUSE, Yui 2013-05-21 08:17:58 UTC 
Sure if it is such policy.
Comment 9 Anne 2014-01-14 13:17:01 UTC 
I think this is now sufficiently clear.

http://url.spec.whatwg.org/#concept-url-parser