RESOLVED INVALID 21977
KURL should prohibit most escape sequences in hostnames 
https://bugs.webkit.org/show_bug.cgi?id=21977
Summary KURL should prohibit most escape sequences in hostnames
Brett Wilson (Google)
Reported 2008-10-30 11:26:01 PDT
KURL allows hostnames such as "hello%03world" or even more scarily "hello%00world" or "hello%2fworld" (which will unescape to "hello/world"). If the URL is extracted and unescaped (many of the component getters unescape by default, including host()) and passed to another system, such as the native OS's URL object, it could be treated as a completely different URL, with different security policy. Google Chrome uses the lookup table at the top of this file: http://code.google.com/p/google-url/source/browse/trunk/src/url_canon_host.cc Characters marked with "kEsc" are allowed to be escaped, while characters marked with 0 are disallowed either escaped or unescaped in hostnames. This table prohibits control charcters, characters that may change the parsing of the URL if unescaped like /?#, and NULL. I think KURL needs to do the same.
Attachments
Add attachment proposed patch, testcase, etc.
Anne van Kesteren
Comment 1 2023-05-22 03:47:21 PDT
KURL is gone.
Note You need to log in before you can comment on or make changes to this bug.