127970 2014-01-30 17:09:56 -0800 Solidus stripping in DOMURL::setHostname seems wrong 2023-01-25 09:27:17 -0800 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 128023 1 mjs cdumez achristensen ap cdumez changseok esprehn+autocc ews-watchlist gyuyoung.kim timothygu99 webkit-bug-importer oldest_to_newest 974114 0 mjs 2014-01-30 17:09:56 -0800 This code in setHostname (also in HTMLAnchorElement) seems dubious and is probably wrong: void DOMURL::setHostname(const String& value) { // Before setting new value: // Remove all leading U+002F SOLIDUS ("/") characters. unsigned i = 0; unsigned hostLength = value.length(); while (value[i] == '/') i++; 1762767 1 timothygu99 2021-05-21 22:19:10 -0700 Worth noting that setHost() doesn't do the solidus stripping. Equivalent Chromium bug is https://crbug.com/1212318 1763180 2 achristensen 2021-05-24 10:25:04 -0700 This code has changed quite a bit since this bug was reported in 2014. It is now URLDecomposition::setHost which doesn't have the solidus removal. If there's a behavior problem related to this, feel free to reopen or file a new bug. 1763267 3 timothygu99 2021-05-24 15:04:21 -0700 This is still an issue, but it only affects setHostname(), not setHost(). I don't have permissions to reopen this bug, but consider u = new URL('http://abc/'); u.hostname = '////def'; console.log(u.href); versus u = new URL('http://abc/'); u.host = '////def'; console.log(u.href); In the first case, the resultant URL is http://def/, while in the second it is http://abc/. The code that does this has indeed moved to URLDecomposition: https://github.com/WebKit/WebKit/blob/4d78e56eb5b61d8f62844ab855e411477d031870/Source/WebCore/html/URLDecomposition.cpp#L152 Search for "removeAllLeadingSolidusCharacters". 1763339 4 ap 2021-05-24 17:03:50 -0700 Reopening per the above comment. 1763566 5 429665 cdumez 2021-05-25 10:33:47 -0700 Created attachment 429665 Patch 1763589 6 429665 cdumez 2021-05-25 11:36:42 -0700 Comment on attachment 429665 Patch The issue with making this change is that I think we would stop matching other browsers. 1763828 7 timothygu99 2021-05-25 22:47:00 -0700 Hi Chris, contrary to the commit message, this change would actually _increase_ compatibility with the spec and Firefox. You can tell from the WPT rebaseline that it increases spec compliance, as it passes more tests than before. I am planning to make the change in Chromium as well soon, after some related changes get released first. 1763899 8 cdumez 2021-05-26 07:56:07 -0700 (In reply to Timothy Gu from comment #7) > Hi Chris, contrary to the commit message, this change would actually > _increase_ compatibility with the spec and Firefox. You can tell from the > WPT rebaseline that it increases spec compliance, as it passes more tests > than before. I am planning to make the change in Chromium as well soon, > after some related changes get released first. I am not sure what you mean by increasing compatibility. Matching the spec does not improve compatibility if no browser matches the spec. As far as I can tell, NO major browser passes this particular WPT test (including the stable version of Firefox I tested). As a result, I believe the spec and WPT test may need to be updated to match browsers instead? 1763936 9 achristensen 2021-05-26 09:29:30 -0700 Firefox follows the spec here but fails that test because it doesn't do anything when setting a hostname that is only solidus characters. Chrome has the same behavior as WebKit here. Because of that I don't think this is the right time for us to make this change. 1927711 10 timothygu99 2023-01-23 21:13:55 -0800 2023 update: both Chrome and Firefox now follow the spec. Given the following, Chrome and Firefox both print "http://x/". Safari is the only one that prints "http://abc/". u = new URL('http://x/'); u.hostname = '/abc'; console.log(u.href); 1927865 11 cdumez 2023-01-24 10:50:08 -0800 Ok, I'll take a look. 1927886 12 cdumez 2023-01-24 11:57:54 -0800 Pull request: https://github.com/WebKit/WebKit/pull/9062 1928160 13 ews-feeder 2023-01-25 09:26:32 -0800 Committed 259366@main (865cbc8abfc5): <https://commits.webkit.org/259366@main> Reviewed commits have been landed. Closing PR #9062 and removing active labels. 1928162 14 webkit-bug-importer 2023-01-25 09:27:17 -0800 <rdar://problem/104650674> 429665 2021-05-25 10:33:47 -0700 2021-05-25 11:36:42 -0700 Patch bug-127970-20210525103346.patch text/plain 3817 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjc4MDEwCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggY2Y3NTJkMzllM2FmN2Qz YTBkMTZhNTQ4MDE5ZWYwMjI5OTljNDQ1Yi4uNjc4YTkxMjZjMGUwNjI1MmJiNmYzYmEzYmU5ZDMy NjZkMGZjNjA3ZCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE5IEBACisyMDIxLTA1LTI1ICBDaHJp cyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CisKKyAgICAgICAgU29saWR1cyBzdHJpcHBpbmcg aW4gRE9NVVJMOjpzZXRIb3N0bmFtZSBzZWVtcyB3cm9uZworICAgICAgICBodHRwczovL2J1Z3Mu d2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTI3OTcwCisKKyAgICAgICAgUmV2aWV3ZWQgYnkg Tk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgU3RvcCBzdHJpcHBpbmcgc29saWR1cyBpbiBVUkwu aG9zdG5hbWUgc2V0dGVyLiBUaGlzIGRvZXMgbm90IG1hdGNoIEJsaW5rIG9yIHRoZQorICAgICAg ICBVUkwgc3BlY2lmaWNhdGlvbi4KKworICAgICAgICBObyBuZXcgdGVzdHMsIHJlYmFzZWxpbmVk IGV4aXN0aW5nIHRlc3QuCisKKyAgICAgICAgKiBodG1sL1VSTERlY29tcG9zaXRpb24uY3BwOgor ICAgICAgICAoV2ViQ29yZTo6VVJMRGVjb21wb3NpdGlvbjo6c2V0SG9zdG5hbWUpOgorICAgICAg ICAoV2ViQ29yZTo6cmVtb3ZlQWxsTGVhZGluZ1NvbGlkdXNDaGFyYWN0ZXJzKTogRGVsZXRlZC4K KwogMjAyMS0wNS0yNSAgQWxhbiBCdWp0YXMgIDx6YWxhbkBhcHBsZS5jb20+CiAKICAgICAgICAg W0xGQ11bVEZDXSBQZXJjZW50IGhlaWdodCByZXNvbHZpbmcgcXVpcmsgc2hvdWxkIHN0b3AgYXQg dGhlIHRhYmxlIGZvcm1hdHRpbmcgY29udGV4dCByb290CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2Vi Q29yZS9odG1sL1VSTERlY29tcG9zaXRpb24uY3BwIGIvU291cmNlL1dlYkNvcmUvaHRtbC9VUkxE ZWNvbXBvc2l0aW9uLmNwcAppbmRleCAwNDk4NjI4ZjhlNmE2OWI2MmY0YWI4ZDUyMDBiYTE2OWE1 ZDQ2OTllLi42Y2QzYzQ4NzYzNWE0NDdiNjY0YjM3YjVhNjM4NTQyOTkxOGRhZWFlIDEwMDY0NAot LS0gYS9Tb3VyY2UvV2ViQ29yZS9odG1sL1VSTERlY29tcG9zaXRpb24uY3BwCisrKyBiL1NvdXJj ZS9XZWJDb3JlL2h0bWwvVVJMRGVjb21wb3NpdGlvbi5jcHAKQEAgLTEzNSwyMSArMTM1LDkgQEAg U3RyaW5nIFVSTERlY29tcG9zaXRpb246Omhvc3RuYW1lKCkgY29uc3QKICAgICByZXR1cm4gZnVs bFVSTCgpLmhvc3QoKS50b1N0cmluZygpOwogfQogCi1zdGF0aWMgU3RyaW5nVmlldyByZW1vdmVB bGxMZWFkaW5nU29saWR1c0NoYXJhY3RlcnMoU3RyaW5nVmlldyBzdHJpbmcpCi17Ci0gICAgdW5z aWduZWQgaTsKLSAgICB1bnNpZ25lZCBsZW5ndGggPSBzdHJpbmcubGVuZ3RoKCk7Ci0gICAgZm9y IChpID0gMDsgaSA8IGxlbmd0aDsgKytpKSB7Ci0gICAgICAgIGlmIChzdHJpbmdbaV0gIT0gJy8n KQotICAgICAgICAgICAgYnJlYWs7Ci0gICAgfQotICAgIHJldHVybiBzdHJpbmcuc3Vic3RyaW5n KGkpOwotfQotCi12b2lkIFVSTERlY29tcG9zaXRpb246OnNldEhvc3RuYW1lKFN0cmluZ1ZpZXcg dmFsdWUpCit2b2lkIFVSTERlY29tcG9zaXRpb246OnNldEhvc3RuYW1lKFN0cmluZ1ZpZXcgaG9z dCkKIHsKICAgICBhdXRvIGZ1bGxVUkwgPSB0aGlzLT5mdWxsVVJMKCk7Ci0gICAgYXV0byBob3N0 ID0gcmVtb3ZlQWxsTGVhZGluZ1NvbGlkdXNDaGFyYWN0ZXJzKHZhbHVlKTsKICAgICBpZiAoaG9z dC5pc0VtcHR5KCkgJiYgIWZ1bGxVUkwucHJvdG9jb2xJcygiZmlsZSIpKQogICAgICAgICByZXR1 cm47CiAgICAgaWYgKGZ1bGxVUkwuY2Fubm90QmVBQmFzZVVSTCgpIHx8ICFmdWxsVVJMLmNhblNl dEhvc3RPclBvcnQoKSkKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2ltcG9ydGVkL3czYy9DaGFu Z2VMb2cgYi9MYXlvdXRUZXN0cy9pbXBvcnRlZC93M2MvQ2hhbmdlTG9nCmluZGV4IGNmMDM2ZmU5 OWRjNTMzY2Q1ZmExZDhjOGVjYjg0ODFlMjE1NzQ1YWMuLjM4OTI0MWViNDhjMmU0YmQ2NTlhNjQy OGNiYmI5MDEwMzM4MWVkYTIgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL2ltcG9ydGVkL3czYy9D aGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMvaW1wb3J0ZWQvdzNjL0NoYW5nZUxvZwpAQCAtMSwz ICsxLDE0IEBACisyMDIxLTA1LTI1ICBDaHJpcyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CisK KyAgICAgICAgU29saWR1cyBzdHJpcHBpbmcgaW4gRE9NVVJMOjpzZXRIb3N0bmFtZSBzZWVtcyB3 cm9uZworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTI3 OTcwCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgUmVi YXNlbGluZSBXUFQgdGVzdCB0aGF0IGlzIG5vdyBwYXNzaW5nLgorCisgICAgICAgICogd2ViLXBs YXRmb3JtLXRlc3RzL3VybC91cmwtc2V0dGVycy1leHBlY3RlZC50eHQ6CisKIDIwMjEtMDUtMjUg IFRpbSBOZ3V5ZW4gIDxudGltQGFwcGxlLmNvbT4KIAogICAgICAgICBBZGQgYmFzaWMgPGRpYWxv Zz4gZWxlbWVudCBVQSBzdHlsZXMKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2ltcG9ydGVkL3cz Yy93ZWItcGxhdGZvcm0tdGVzdHMvdXJsL3VybC1zZXR0ZXJzLWV4cGVjdGVkLnR4dCBiL0xheW91 dFRlc3RzL2ltcG9ydGVkL3czYy93ZWItcGxhdGZvcm0tdGVzdHMvdXJsL3VybC1zZXR0ZXJzLWV4 cGVjdGVkLnR4dAppbmRleCA4M2UyODBiMjY4NWQ0M2MzOGYzY2RiMGNmNWJkZWNlNTg2NTVhOTg5 Li5hMGM5MDY5YzM4NjkxNTVhZjIyMmUyOTNkZjZiMWE0MTI4NzU1OTI3IDEwMDY0NAotLS0gYS9M YXlvdXRUZXN0cy9pbXBvcnRlZC93M2Mvd2ViLXBsYXRmb3JtLXRlc3RzL3VybC91cmwtc2V0dGVy cy1leHBlY3RlZC50eHQKKysrIGIvTGF5b3V0VGVzdHMvaW1wb3J0ZWQvdzNjL3dlYi1wbGF0Zm9y bS10ZXN0cy91cmwvdXJsLXNldHRlcnMtZXhwZWN0ZWQudHh0CkBAIC0zNDIsOSArMzQyLDkgQEAg UEFTUyA8YXJlYT46IFNldHRpbmcgPHNjOi8veC8+Lmhvc3RuYW1lID0gJyAnCiBQQVNTIFVSTDog U2V0dGluZyA8c2M6Ly94Lz4uaG9zdG5hbWUgPSAnIycKIFBBU1MgPGE+OiBTZXR0aW5nIDxzYzov L3gvPi5ob3N0bmFtZSA9ICcjJwogUEFTUyA8YXJlYT46IFNldHRpbmcgPHNjOi8veC8+Lmhvc3Ru YW1lID0gJyMnCi1GQUlMIFVSTDogU2V0dGluZyA8c2M6Ly94Lz4uaG9zdG5hbWUgPSAnLycgYXNz ZXJ0X2VxdWFsczogZXhwZWN0ZWQgInNjOi8vLyIgYnV0IGdvdCAic2M6Ly94LyIKLUZBSUwgPGE+ OiBTZXR0aW5nIDxzYzovL3gvPi5ob3N0bmFtZSA9ICcvJyBhc3NlcnRfZXF1YWxzOiBleHBlY3Rl ZCAic2M6Ly8vIiBidXQgZ290ICJzYzovL3gvIgotRkFJTCA8YXJlYT46IFNldHRpbmcgPHNjOi8v eC8+Lmhvc3RuYW1lID0gJy8nIGFzc2VydF9lcXVhbHM6IGV4cGVjdGVkICJzYzovLy8iIGJ1dCBn b3QgInNjOi8veC8iCitQQVNTIFVSTDogU2V0dGluZyA8c2M6Ly94Lz4uaG9zdG5hbWUgPSAnLycK K1BBU1MgPGE+OiBTZXR0aW5nIDxzYzovL3gvPi5ob3N0bmFtZSA9ICcvJworUEFTUyA8YXJlYT46 IFNldHRpbmcgPHNjOi8veC8+Lmhvc3RuYW1lID0gJy8nCiBQQVNTIFVSTDogU2V0dGluZyA8c2M6 Ly94Lz4uaG9zdG5hbWUgPSAnPycKIFBBU1MgPGE+OiBTZXR0aW5nIDxzYzovL3gvPi5ob3N0bmFt ZSA9ICc/JwogUEFTUyA8YXJlYT46IFNldHRpbmcgPHNjOi8veC8+Lmhvc3RuYW1lID0gJz8nCg==