forked from whatwg/url
-
Notifications
You must be signed in to change notification settings - Fork 0
/
url.bs
3031 lines (2289 loc) · 109 KB
/
url.bs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<pre class="metadata">
Title: URL Standard
Group: WHATWG
H1: URL
Shortname: url
Status: LS
No Editor: true
Abstract: The URL Standard defines URLs, domains, IP addresses, the <code title>application/x-www-form-urlencoded</code> format, and their API.
Logo: https://resources.whatwg.org/logo-url.svg
!Participate: <a href=https://github.com/whatwg/url>GitHub whatwg/url</a> (<a href=https://github.com/whatwg/url/issues/new>new issue</a>, <a href="https://github.com/whatwg/url/issues">open issues</a>, <a href="https://www.w3.org/Bugs/Public/buglist.cgi?product=WHATWG&component=URL&resolution=---">legacy open bugs</a>)
!Participate: <a href="https://wiki.whatwg.org/wiki/IRC">IRC: #whatwg on Freenode</a>
!Commits: <a href="https://github.com/whatwg/url/commits">https://github.com/whatwg/url/commits</a>
!Commits: <a href="https://twitter.com/urlstandard">@urlstandard</a>
Indent: 2
Boilerplate: omit feedback-header
</pre>
<script src=https://resources.whatwg.org/file-issue.js async></script>
<script id=head src=https://resources.whatwg.org/dfn.js defer></script>
<h2 id=goals class=no-num>Goals</h2>
<p>The URL standard takes the following approach towards making URLs fully interoperable:
<ul>
<li><p>Align RFC 3986 and RFC 3987 with contemporary implementations and
obsolete them in the process. (E.g., spaces, other "illegal" code points,
query encoding, equality, canonicalization, are all concepts not entirely
shared, or defined.) URL parsing needs to become as solid as HTML parsing.
[[RFC3986]]
[[RFC3987]]
<li><p>Standardize on the term URL. URI and IRI are just confusing. In
practice a single algorithm is used for both so keeping them distinct is
not helping anyone. URL also easily wins the
<a href="http://www.googlefight.com/index.php?word1=url&word2=uri">search result popularity contest</a>.
<li><p>Supplanting <a href="https://tools.ietf.org/html/rfc6454#section-4">Origin of a URI [sic]</a>.
[[RFC6454]]
<li><p>Define URL's existing JavaScript API in full detail and add
enhancements to make it easier to work with. Add a new <code><a interface>URL</a></code>
object as well for URL manipulation without usage of HTML elements. (Useful
for JavaScript worker environments.)
</ul>
<p class=note>As the editors learn more about the subject matter the goals
might increase in scope somewhat.
<h2 id=infrastructure>Infrastructure</h2>
<p>Some terms used in this specification are defined in the
DOM, Encoding, IDNA, and Web IDL Standards.
[[!DOM]]
[[!ENCODING]]
[[!IDNA]]
[[!WEBIDL]]
<p>The <dfn>C0 controls</dfn> are code points in the range U+0000 to U+001F, inclusive.
<p>The <dfn>C0 controls and space</dfn> are <a>C0 controls</a> and code point U+0020.
<p>The <dfn>tab and newline</dfn> are code points U+0009, U+000A, and U+000D.
<p>The <dfn>ASCII digits</dfn> are code points in the range U+0030 to U+0039, inclusive.
<p>The <dfn>ASCII hex digits</dfn> are <a>ASCII digits</a>, code points in the range
U+0041 to U+0046, inclusive, and code points in the range U+0061 to U+0066, inclusive.
<p>The <dfn>ASCII alpha</dfn> are code points in the range U+0041 to U+005A, inclusive,
and in the range U+0061 to U+007A, inclusive.
<p>The <dfn>ASCII alphanumeric</dfn> are <a>ASCII digits</a> and <a>ASCII alpha</a>.
<p>An <dfn>ASCII string</dfn> is a <a>string</a> in the range U+0000 to U+007F, inclusive.
<p>To <dfn>ASCII lowercase</dfn> a <a>string</a>, replace all code points in the range
U+0041 to U+005A, inclusive, with the corresponding code points in the range
U+0061 to U+007A, inclusive.
<hr>
<p>To <dfn>serialize an integer</dfn>, represent it as the shortest possible decimal
number.
<hr>
<p>A <dfn>Windows drive letter</dfn> is two code points, of which the first is
an <a>ASCII alpha</a> and the second is either "<code>:</code>" or "<code>|</code>".
<p>A <dfn>normalized Windows drive letter</dfn> is a <a>Windows drive letter</a> of which
the second code point is "<code>:</code>".
<h3 id=parsers>Parsers</h3>
<p>The <dfn>EOF code point</dfn> is a conceptual code point that signifies the end of a
string or code point stream.
<p>Within a parser algorithm that uses a <var>pointer</var> variable, <dfn>c</dfn>
references the code point the <var>pointer</var> variable points to.
<p>Within a string-based parser algorithm that uses a <var>pointer</var> variable,
<dfn>remaining</dfn> references the substring after <var>pointer</var> in the string
being processed.
<p class=example>If "<code>mailto:username@example</code>" is a string being
processed and <var>pointer</var> points to "<code>@</code>",
<a>c</a> is "<code>@</code>" and <a>remaining</a> is
"<code>example</code>".
<p>A <dfn>syntax violation</dfn> indicates a non-fatal mismatch between input and syntax
requirements. User agents, especially conformance checkers are encouraged to report them
somewhere.
<p class="note no-backref">A <a>syntax violation</a> does not mean that the parser
terminates. Termination of a parser is always stated explicitly. E.g., through a return
statement.
<h3 id=percent-encoded-bytes>Percent-encoded bytes</h3>
<p>A <dfn>percent-encoded byte</dfn> is "<code>%</code>", followed by two <a>ASCII hex digits</a>.
Sequences of <a lt="percent-encoded byte">percent-encoded bytes</a>, after conversion to bytes,
should not cause <a>UTF-8 decode without BOM or fail</a> to return failure.
<p>To <dfn>percent encode</dfn> a <var>byte</var> into a
<a>percent-encoded byte</a>, return a string consisting of
"<code>%</code>", followed by a double-digit, uppercase, hexadecimal
representation of <var>byte</var>.
<p>To <dfn>percent decode</dfn> a byte sequence <var>input</var>, run these steps:
<p class=warning>Using anything but <a>UTF-8 decode without BOM</a> when the <var>input</var>
contains bytes that are not <a>ASCII bytes</a> might be insecure and is not recommended.
<ol>
<li><p>Let <var>output</var> be an empty byte sequence.
<li>
<p>For each byte <var>byte</var> in <var>input</var>, run these steps:
<ol>
<li><p>If <var>byte</var> is not `<code>%</code>`, append
<var>byte</var> to <var>output</var>.
<li><p>Otherwise, if <var>byte</var> is `<code>%</code>` and the next two
bytes after <var>byte</var> in <var>input</var> are not in the ranges
0x30 to 0x39, 0x41 to 0x46, and 0x61 to 0x66, append <var>byte</var> to
<var>output</var>.
<li>
<p>Otherwise, run these substeps:
<ol>
<li><p>Let <var>bytePoint</var> be the two bytes after <var>byte</var> in
<var>input</var>,
<a lt="utf-8 decode without BOM">decoded</a>, and
then interpreted as hexadecimal number.
<!-- We should have a definition for this that is saner. -->
<li><p>Append a byte whose value is <var>bytePoint</var> to
<var>output</var>.
<li><p>Skip the next two bytes in <var>input</var>.
</ol>
</ol>
<li><p>Return <var>output</var>.
</ol>
<!-- the escape sets are minimal as escaping can lead to problems; we might
be able to escape more here but only if implementors are willing and
there's an upside
note that query and application/x-www-form-urlencoded use their own
local sets -->
<p>The <dfn>simple encode set</dfn> are <a>C0 controls</a> and all code points greater
than U+007E.
<p>The <dfn>default encode set</dfn> is the
<a>simple encode set</a> and code points U+0020,
'<code>"</code>', <!-- 0x22 -->
"<code>#</code>", <!-- 0x23 -->
"<code><</code>", <!-- 0x3C -->
"<code>></code>", <!-- 0x3E -->
"<code>?</code>", <!-- 0x3F -->
"<code>`</code>", <!-- 0x60 -->
"<code>{</code>", <!-- 0x7B -->
and
"<code>}</code>". <!-- 0x7D -->
<p>The <dfn>userinfo encode set</dfn> is the
<a>default encode set</a> and code points
"<code>/</code>", <!-- 0x2F -->
"<code>:</code>", <!-- 0x3A -->
"<code>;</code>", <!-- 0x3B -->
"<code>=</code>", <!-- 0x3D -->
"<code>@</code>", <!-- 0x40 -->
"<code>[</code>", <!-- 0x5B -->
"<code>\</code>", <!-- 0x5C -->
"<code>]</code>", <!-- 0x5D -->
"<code>^</code>", <!-- 0x5E -->
and
"<code>|</code>". <!-- 0x7C -->
<p>To <dfn>UTF-8 percent encode</dfn> a <var>codePoint</var>, using
an <var>encode set</var>, run these steps:
<ol>
<li><p>If <var>codePoint</var> is not in <var>encode set</var>, return
<var>codePoint</var>.
<li><p>Let <var>bytes</var> be the result of running <a>UTF-8 encode</a> on
<var>codePoint</var>.
<li><p><a>Percent encode</a> each byte in <var>bytes</var>, and then return the results
concatenated, in the same order.
</ol>
<h2 id=security-considerations>Security considerations</h2>
<p>The security of a <a for=url>URL</a> is a function of its environment. Care is to be
taken when rendering, interpreting, and passing <a for=url lt=URL>URLs</a> around.
<p>When rendering and allocating new <a for=url lt=URL>URLs</a> "spoofing" needs to be
considered. An attack whereby one <a for=host>host</a> or <a for=url>URL</a> can be
confused for another. E.g., consider how 1/l/I, m/rn/rri, 0/O, and а/a can all appear
eerily similar. Or worse, consider how U+202A and similar code points are invisible.
[[!UTS36]]
<p>When passing a <a for=url>URL</a> from party <var>A</var> to <var>B</var>, both need to
carefully consider what is happening. <var>A</var> might end up leaking data it does not
want to leak. <var>B</var> might receive input it did not expect and take an action that
harms the user. In particular, <var>B</var> should never trust <var>A</var>, as at some
point <a for=url lt=URL>URLs</a> from <var>A</var> can come from untrusted sources.
<h2 id="hosts-(domains-and-ip-addresses)">Hosts (domains and IP addresses)</h2>
<!-- Punycode:
https://tools.ietf.org/html/rfc3492
https://mothereff.in/punycode -->
<p>A <dfn export for=host id=concept-host>host</dfn> is a <a for=host>domain</a>, an
<a for=host>IPv4 address</a>, or an <a for=host>IPv6 address</a>. Typically a
<a for=host>host</a> serves as a network address, but it is sometimes (ab)used as opaque
identifier in <a for=url lt=URL>URLs</a> where a network address is not necessary.
<p>A <dfn export for=host id=concept-domain>domain</dfn> identifies a realm within a
network.
[[RFC1034]]
<p>An <dfn export for=host id=concept-ipv4>IPv4 address</dfn> is a 32-bit identifier.
[[RFC791]]
<p>An <dfn export for=host id=concept-ipv6>IPv6 address</dfn> is a 128-bit identifier and
for the purposes of this specification represented as an ordered list of
eight <dfn id=concept-ipv6-piece lt='IPv6 piece'>16-bit pieces</dfn>.
[[RFC4291]]
<p class="note">Support for <code><zone_id></code> is
<a href="https://www.w3.org/Bugs/Public/show_bug.cgi?id=27234#c2">intentionally omitted</a>.
<h3 id=idna>IDNA</h3>
<p>The <dfn id=concept-domain-to-ascii>domain to ASCII</dfn> given a
<a for=host>domain</a> <var>domain</var>, runs these steps:
<ol>
<li><p>Let <var>result</var> be the result of running
<a lt=ToASCII>Unicode ToASCII</a> with
<i>domain_name</i> set to <var>domain</var>,
<i>UseSTD3ASCIIRules</i> set to false, <i>processing_option</i> set to
<i>Transitional_Processing</i>, and <i>VerifyDnsLength</i> set to false.
<li><p>If <var>result</var> is a failure value, <a>syntax violation</a>, return failure.
<li><p>Return <var>result</var>.
</ol>
<p>The <dfn id=concept-domain-to-unicode>domain to Unicode</dfn> given a
<a for=host>domain</a> <var>domain</var>, runs these steps:
<ol>
<li><p>Let <var>result</var> be the result of running
<a lt=ToUnicode>Unicode ToUnicode</a> with
<i>domain_name</i> set to <var>domain</var>,
<i>UseSTD3ASCIIRules</i> set to false.
<li><p>Signify <a>syntax violations</a> for any returned errors, and then, return
<var>result</var>.
</ol>
<h3 id=host-syntax>Host syntax</h3>
<p>A <dfn export for=hostsyntax id=syntax-host>host</dfn> must be a
<a for=hostsyntax>domain</a>, an <a for=hostsyntax>IPv4 address</a>, or "<code>[</code>",
followed by an <a for=hostsyntax>IPv6 address</a>, followed by "<code>]</code>".
<p>A <var>domain</var> is a <dfn>valid domain</dfn> if these steps return success:
<ol>
<li><p>Let <var>result</var> be the result of running
<a lt=ToASCII>Unicode ToASCII</a> with
<i>domain_name</i> set to <var>domain</var>,
<i>UseSTD3ASCIIRules</i> set to true, <i>processing_option</i> set to
<i>Nontransitional_Processing</i>, and <i>VerifyDnsLength</i> set to true.
<li><p>If <var>result</var> is a failure value, return failure.
<li><p>Set <var>result</var> to the result of running
<a lt=ToUnicode>Unicode ToUnicode</a> with
<i>domain_name</i> set to <var>result</var>,
<i>UseSTD3ASCIIRules</i> set to true.
<li><p>If <var>result</var> contains any errors, return failure.
<li><p>Return success.
</ol>
<p class=XXX>Ideally we define this in terms of a sequence of code points that make up a
<a>valid domain</a> rather than through a whack-a-mole:
<a href=https://www.w3.org/Bugs/Public/show_bug.cgi?id=25334>bug 25334</a>.
<p>A <dfn export for=hostsyntax id=syntax-host-domain>domain</dfn> must be a string that
is a <a>valid domain</a>.
<p>An <dfn export for=hostsyntax id=syntax-host-ipv4>IPv4 address</dfn> must be four
sequences of up to three <a>ASCII digits</a> per sequence, each representing a decimal
number no greater than 255, and separated from each other by "<code>.</code>".
<p>An <dfn export for=hostsyntax id=syntax-host-ipv6>IPv6 address</dfn> is defined in the
<a href="https://tools.ietf.org/html/rfc4291#section-2.2">"Text Representation of Addresses" chapter of IP Version 6 Addressing Architecture</a>.
[[!RFC4291]]
<!-- https://tools.ietf.org/html/rfc5952 updates that RFC, but it seems as
far as what developers can do we should be liberal
XXX should we define the format inline instead just like STD 66? -->
<h3 id=host-parsing>Host parsing</h3>
<p>The <dfn id=concept-host-parser>host parser</dfn> takes a string <var>input</var> and
an optional <var>Unicode flag</var> (unset unless stated otherwise), and then runs these
steps:
<ol>
<li>
<p>If <var>input</var> starts with "<code>[</code>", run these
substeps:
<ol>
<li><p>If <var>input</var> does not end with
"<code>]</code>", <a>syntax violation</a>, return failure.
<li><p>Return the result of
<a lt="IPv6 parser">IPv6 parsing</a> <var>input</var>
with its leading "<code>[</code>" and trailing
"<code>]</code>" removed.
</ol>
<li><p>Let <var>domain</var> be the result of
<a>UTF-8 decode without BOM</a> on the
<a lt="percent decode">percent decoding</a> of
<a>UTF-8 encode</a> on <var>input</var>.
<!-- https://bugzilla.mozilla.org/show_bug.cgi?id=309671 -->
<li><p>Let <var>asciiDomain</var> be the result of running
<a>domain to ASCII</a> on <var>domain</var>.
<li><p>If <var>asciiDomain</var> is failure, return failure.
<li>
<p>If <var>asciiDomain</var> contains
U+0000,
U+0009,
U+000A,
U+000D,
U+0020,
"<code>#</code>",<!-- 23 -->
"<code>%</code>",<!-- 25 -->
"<code>/</code>",<!-- 2F -->
"<code>:</code>",<!-- 3A -->
"<code>?</code>",<!-- 3F -->
"<code>@</code>",<!-- 40 -->
"<code>[</code>",<!-- 5B -->
"<code>\</code>",<!-- 5C -->
or
"<code>]</code>",<!-- 5D -->
<a>syntax violation</a>, return failure.
<li><p>Let <var>ipv4Host</var> be the result of <a lt="IPv4 parser">IPv4 parsing</a>
<var>asciiDomain</var>.
<li><p>If <var>ipv4Host</var> is an <a for=host>IPv4 address</a> or failure, return
<var>ipv4Host</var>.
<li><p>Return <var>asciiDomain</var> if the <var>Unicode flag</var> is unset, and the
result of running <a>domain to Unicode</a> on <var>asciiDomain</var> otherwise.
</ol>
The <dfn>IPv4 number parser</dfn> takes a string <var>input</var> and a
<var>syntaxViolationFlag</var> pointer, and then runs these steps:
<ol>
<li><p>Let <var>R</var> be 10.
<li>
<p>If <var>input</var> contains at least two code points and the first two code points
are either "<code>0x</code>" or "<code>0X</code>", run these substeps:
<ol>
<li><p>Set <var>syntaxViolationFlag</var>.
<li><p>Remove the first two code points from <var>input</var>.
<li><p>Set <var>R</var> to 16.
</ol>
<li><p>If <var>input</var> is the empty string, return zero.
<!-- 0x/0X is an IPv4 number apparently -->
<li>
<p>Otherwise, if <var>input</var> contains at least two code points and the first code
point is "<code>0</code>", run these substeps:
<!-- Needs to be at least two code points. Otherwise "0" as input fails to parse. -->
<ol>
<li><p>Set <var>syntaxViolationFlag</var>.
<li><p>Remove the first code point from <var>input</var>.
<li><p>Set <var>R</var> to 8.
</ol>
<li><p>If <var>input</var> contains a code point that is not a radix-<var>R</var> digit,
and return failure.
<!-- There is no need to set syntaxViolationFlag here since it will be used.
XXX radix-R digit, hahaha, that's not a thing -->
<li><p>Return the mathematical integer value that is represented by <var>input</var> in
radix-<var>R</var> notation, using <a>ASCII hex digits</a> for digits with values 0
through 15.
<!-- XXX well, you know, it works for ECMAScript, kinda -->
</ol>
The <dfn id=concept-ipv4-parser>IPv4 parser</dfn> takes a string <var>input</var> and then
runs these steps:
<ol>
<li><p>Let <var>syntaxViolationFlag</var> be unset.
<li><p>Let <var>parts</var> be <var>input</var> split on "<code>.</code>".
<li><p>If the last item in <var>parts</var> is the empty string, set
<var>syntaxViolationFlag</var> and remove the last item from <var>parts</var>.
<li><p>If <var>parts</var> has more than four items, return <var>input</var>.
<li><p>Let <var>numbers</var> be the empty list.
<li>
<p>For each <var>part</var> in <var>parts</var>:
<ol>
<li>
<p>If <var>part</var> is the empty string, return <var>input</var>.
<p class="example no-backref"><code>0..0x300</code> is a <a for=host>domain</a>, not
an <a for=host>IPv4 address</a>.
<li><p>Let <var>n</var> be the result of <a lt="IPv4 number parser">parsing</a>
<var>part</var> using <var>syntaxViolationFlag</var>.
<li><p>If <var>n</var> is failure, return <var>input</var>.
<li><p>Append <var>n</var> to <var>numbers</var>.
</ol>
<li><p>If <var>syntaxViolationFlag</var> is set, <a>syntax violation</a>.
<li><p>If any item in <var>numbers</var> is greater than 255, <a>syntax violation</a>.
<li><p>If any but the last item in <var>numbers</var> is greater than 255, return
failure.
<li><p>If the last item in <var>numbers</var> is greater than or equal to
256<sup>(5 − the number of items in <var>numbers</var>)</sup>,
<a>syntax violation</a>, return failure.
<li><p>Let <var>ipv4</var> be the last item in <var>numbers</var>.
<li><p>Remove the last item from <var>numbers</var>.
<li><p>Let <var>counter</var> be zero.
<li>
<p>For each <var>n</var> in <var>numbers</var>:
<ol>
<li><p>Increment <var>ipv4</var> by <var>n</var> ×
256<sup>(3 − <var>counter</var>)</sup>.
<li><p>Increment <var>counter</var> by one.
</ol>
<li><p>Return <var>ipv4</var>.
</ol>
<p>The <dfn id=concept-ipv6-parser>IPv6 parser</dfn> takes a string <var>input</var> and
then runs these steps:
<ol>
<li><p>Let <var>address</var> be a new <a for=host>IPv6 address</a> with its
<a lt='IPv6 piece'>16-bit pieces</a> initialized to 0.
<li><p>Let <var>piece pointer</var> be a pointer into
<var>address</var>'s
<a lt='IPv6 piece'>16-bit pieces</a>, initially zero
(pointing to the first <a lt='IPv6 piece'>16-bit piece</a>),
and let <var>piece</var> be the
<a lt='IPv6 piece'>16-bit piece</a> it points to.
<li><p>Let <var>compress pointer</var> be another pointer into
<var>address</var>'s <a lt='IPv6 piece'>16-bit pieces</a>, initially
null and pointing to nothing.
<li><p>Let <var>pointer</var> be a pointer into
<var>input</var>, initially zero (pointing to the first code point).
<li>
<p>If <a>c</a> is "<code>:</code>", run these substeps:
<ol>
<li><p>If <a>remaining</a> does not start with "<code>:</code>",
<a>syntax violation</a>, return failure.
<li><p>Increase <var>pointer</var> by two.
<li><p>Increase <var>piece pointer</var> by one and then set
<var>compress pointer</var> to <var>piece pointer</var>.
</ol>
<li>
<p><dfn id=concept-ipv6-parser-main lt='IPv6 parser Main'>Main</dfn>:
While <a>c</a> is not the <a>EOF code point</a>, run these
substeps:
<ol>
<li><p>If <var>piece pointer</var> is eight, <a>syntax violation</a>, return failure.
<li>
<p>If <a>c</a> is "<code>:</code>", run these inner
substeps:
<ol>
<li><p>If <var>compress pointer</var> is non-null, <a>syntax violation</a>,
return failure.
<li>Increase <var>pointer</var> and <var>piece pointer</var> by one, set
<var>compress pointer</var> to <var>piece pointer</var>,
and then jump to <a lt='IPv6 parser Main'>Main</a>.
</ol>
<li><p>Let <var>value</var> and <var>length</var> be 0.
<li><p>While <var>length</var> is less than 4 and
<a>c</a> is an
<a lt="ASCII hex digits">ASCII hex digit</a>, set
<var>value</var> to
<var>value</var> × 0x10 + <a>c</a> interpreted as hexadecimal number,
and increase <var>pointer</var> and <var>length</var> by one.
<li>
<p>Switching on <a>c</a>:
<dl class=switch>
<dt>"<code>.</code>"
<dd>
<ol>
<li><p>If <var>length</var> is 0, <a>syntax violation</a>, return failure.
<li><p>Decrease <var>pointer</var> by <var>length</var>.
<li><p>Jump to <a lt='IPv6 parser IPv4'>IPv4</a>.
</ol>
<dt>"<code>:</code>"
<dd>
<ol>
<li><p>Increase <var>pointer</var> by one.
<li><p>If <a>c</a> is the <a>EOF code point</a>, <a>syntax violation</a>,
return failure.
</ol>
<dt>Anything but the <a>EOF code point</a>
<dd><p><a>Syntax violation</a>, return failure.
</dl>
<li><p>Set <var>piece</var> to <var>value</var>.
<li><p>Increase <var>piece pointer</var> by one.
</ol>
<li><p>If <a>c</a> is the <a>EOF code point</a>, jump to
<a lt='IPv6 parser Finale'>Finale</a>.
<li><p><dfn id=concept-ipv6-parser-ipv4 lt='IPv6 parser IPv4'>IPv4</dfn>:
If <var>piece pointer</var> is greater than six, <a>syntax violation</a>, return failure.
<li><p>Let <var>dots seen</var> be 0.
<li>
<p>While <a>c</a> is not the <a>EOF code point</a>, run
these substeps:
<ol>
<li><p>Let <var>value</var> be null.
<li><p>If <a>c</a> is not an <a>ASCII digit</a>, <a>syntax violation</a>,
return failure. <!-- prevent the empty string -->
<li>
<p>While <a>c</a> is an <a>ASCII digit</a>, run these subsubsteps:
<ol>
<li><p>Let <var>number</var> be <a>c</a> interpreted as decimal number.
<li>
<p>If <var>value</var> is null, set <var>value</var> to <var>number</var>.
<p>Otherwise, if <var>value</var> is 0, <a>syntax violation</a>, return failure.
<p>Otherwise, set <var>value</var> to <var>value</var> × 10 + <var>number</var>.
<li><p>Increase <var>pointer</var> by one.
<li><p>If <var>value</var> is greater than 255, <a>syntax violation</a>,
return failure.
</ol>
<li><p>If <var>dots seen</var> is less than 3 and
<a>c</a> is not a "<code>.</code>",
<a>syntax violation</a>, return failure.
<li><p>Set <var>piece</var> to
<var>piece</var> × 0x100 + <var>value</var>.
<li><p>If <var>dots seen</var> is 1 or 3, increase
<var>piece pointer</var> by one.
<li><p>If <a>c</a> is not the <a>EOF code point</a>, increase <var>pointer</var> by
one.
<li><p>If <var>dots seen</var> is 3 and <a>c</a> is not
the <a>EOF code point</a>,
<a>syntax violation</a>, return failure.
<li><p>Increase <var>dots seen</var> by one.
</ol>
<li>
<p><dfn id=concept-ipv6-parser-finale lt='IPv6 parser Finale'>Finale</dfn>:
If <var>compress pointer</var> is non-null, run these substeps:
<ol>
<li><p>Let <var>swaps</var> be
<var>piece pointer</var> − <var>compress pointer</var>.
<li><p>Set <var>piece pointer</var> to seven.
<li><p>While <var>piece pointer</var> is not zero and <var>swaps</var> is
greater than zero, swap <var>piece</var> with the
<a lt='IPv6 piece'>piece</a> at pointer
<var>compress pointer</var> + <var>swaps</var> − 1, and then
decrease both <var>piece pointer</var> and <var>swaps</var> by one.
</ol>
<li><p>Otherwise, if <var>compress pointer</var> is null and <var>piece pointer</var> is
not eight, <a>syntax violation</a>, return failure.
<li><p>Return <var>address</var>.
</ol>
<p class="note no-backref">To be clear, <a lt='IPv6 parser Main'>Main</a>,
<a lt='IPv6 parser IPv4'>IPv4</a>, and <a lt='IPv6 parser Finale'>Finale</a> are simple markers.
They serve no purpose other than being a location the algorithm can jump to.
<h3 id=host-serializing>Host serializing</h3>
<p>The <dfn id=concept-host-serializer lt="host serializer">host serializer</dfn> takes a
<a for=host>host</a> <var>host</var> and then runs these steps:
<ol>
<li><p>If <var>host</var> is an <a for=host>IPv4 address</a>, return the result of
running the <a>IPv4 serializer</a> on <var>host</var>.
<li><p>Otherwise, if <var>host</var> is an <a for=host>IPv6 address</a>, return
"<code>[</code>", followed by the result of running the
<a>IPv6 serializer</a> on <var>host</var>,
followed by "<code>]</code>".
<li><p>Otherwise, <var>host</var> is a <a for=host>domain</a>, return <var>host</var>.
</ol>
The <dfn id=concept-ipv4-serializer>IPv4 serializer</dfn> takes an
<a for=host>IPv4 address</a> <var>address</var> and then runs these steps:
<ol>
<li><p>Let <var>output</var> be the empty string.
<li><p>Let <var>n</var> be the value of <var>address</var>.
<li>
<p>Repeat four times:
<ol>
<li><p>Prepend <var>n</var> % 256, <a lt="serialize an integer">serialized</a>, to
<var>output</var>.
<li><p>Unless this is the fourth time, prepend "<code>.</code>" to <var>output</var>.
<li><p>Set <var>n</var> to floor(<var>n</var> / 256).
</ol>
<li><p>Return <var>output</var>.
</ol>
<p>The <dfn id=concept-ipv6-serializer>IPv6 serializer</dfn> takes an
<a for=host>IPv6 address</a> <var>address</var> and then runs these steps:
<ol>
<li><p>Let <var>output</var> be the empty string.
<li>
<p>Let <var>compress pointer</var> be a pointer to the first
<a lt='IPv6 piece'>16-bit piece</a> in the first longest
sequences of <var>address</var>'s
<a lt='IPv6 piece'>16-bit pieces</a> that are 0.
<p class=example>In <code>0:f:0:0:f:f:0:0</code> it would point to
the second 0.
<li><p>If there is no sequence of <var>address</var>'s
<a lt='IPv6 piece'>16-bit pieces</a> that are 0 longer than
one, set <var>compress pointer</var> to null.
<li>
<p>For each <var>piece</var> in <var>address</var>'s
<a lt='IPv6 piece'>pieces</a>, run these substeps:
<ol>
<li><p>If <var>compress pointer</var> points to
<var>piece</var>, append "<code>::</code>" to
<var>output</var> if <var>piece</var> is
<var>address</var>'s first <a lt='IPv6 piece'>piece</a> and append
"<code>:</code>" otherwise, and then run these substeps again with all
subsequent <a lt='IPv6 piece'>pieces</a> in
<var>address</var>'s <a lt='IPv6 piece'>pieces</a>
that are 0 skipped or go the next step in the overall set of steps if
that leaves no <a lt='IPv6 piece'>pieces</a>.
<li><p>Append <var>piece</var>, represented as the shortest
possible lowercase hexadecimal number, to <var>output</var>.
<li><p>If <var>piece</var> is not
<var>address</var>'s last <a lt='IPv6 piece'>piece</a>,
append "<code>:</code>" to <var>output</var>.
</ol>
<li><p>Return <var>output</var>.
</ol>
<p class=note>This algorithm requires the recommendation from
A Recommendation for IPv6 Address Text Representation.
[[RFC5952]]
<!-- Safari/Gecko/Opera do not normalize IPv6. Chrome does. This algorithm
follows Chrome because we normalize domains too. -->
<h3 id=host-equivalence>Host equivalence</h3>
To determine whether a <a for=host>host</a> <var>A</var>
<dfn export for=host id=concept-host-equals>equals</dfn> <var>B</var>, return true if
<var>A</var> is <var>B</var>, and false otherwise.
<p class=XXX>Certificate comparison requires a host equivalence check that ignores the
trailing dot of a domain (if any). However, those hosts have also various other facets
enforced, such as DNS length, that are not enforced here, as URLs do not enforce them. If
anyone has a good suggestion for how to bring these two closer together, or what a good
unified model would be, please file an issue.
<h2 id=urls>URLs</h2>
<!-- History behind URL as term:
https://lists.w3.org/Archives/Public/uri/2012Oct/0080.html -->
<p>A <dfn export for=url id=concept-url lt="URL|URL record">URL</dfn> is a universal
identifier. To disambiguate from a <a>URL string</a> it can also be referred to as a
<a>URL record</a>.
<p>A <a for=url>URL</a>'s <dfn export for=url id=concept-url-scheme>scheme</dfn> is an
<a>ASCII string</a> that identifies the type of <a for=url>URL</a> and can be used to
dispatch a <a for=url>URL</a> for further processing after <a lt='URL parser'>parsing</a>.
It is initially the empty string.
<p>A <a for=url>URL</a>'s <dfn export for=url id=concept-url-username>username</dfn> is
an <a>ASCII string</a> identifying a user. It is initially the empty string.
<p>A <a for=url>URL</a>'s <dfn export for=url id=concept-url-password>password</dfn> is
either null or an <a>ASCII string</a> identifying a user's credentials. It is initially
null.
<p>A <a for=url>URL</a>'s <dfn export for=url id=concept-url-host>host</dfn> is either
null or a <a for=host>host</a>. It is initially null.
<p>A <a for=url>URL</a>'s <dfn export for=url id=concept-url-port>port</dfn> is either
null or a 16-bit unsigned integer that identifies a networking port. It is initially null.
<p>A <a for=url>URL</a>'s <dfn export for=url id=concept-url-path>path</dfn> is a list of
zero or more <a>ASCII string</a> holding data, usually identifying a location in
hierarchical form. It is initially the empty list.
<p>A <a for=url>URL</a>'s <dfn export for=url id=concept-url-query>query</dfn> is either
null or an <a>ASCII string</a> holding data. It is initially null.
<p>A <a for=url>URL</a>'s <dfn export for=url id=concept-url-fragment>fragment</dfn> is
either null or a string holding data that can be used for further processing on the
resource the <a for=url>URL</a>'s other components identify. It is initially null.
<p class="note no-backref">This is not an <a>ASCII string</a> on purpose.
<p>A <a for=url>URL</a> also has an associated
<dfn><span id=non-relative-flag>cannot-be-a-base-URL flag</span></dfn>.
It is initially unset.
<p>A <a for=url>URL</a> also has an associated
<dfn export for=url id=concept-url-object>object</dfn> that is either null or a
<code><a>Blob</a></code> object. It is initially null. [[!FILEAPI]]
<p class="note no-backref">At this point this is used primarily to support
"<code>blob</code>" <a for=url lt=URL>URLs</a>, but others can be added going forward, hence
"object".
<hr>
<p>A <dfn>special scheme</dfn> is a <a for=url>scheme</a> listed in the first column of
the following table. A <dfn>default port</dfn> is a <a>special scheme</a>'s optional
corresponding <a for=url>port</a> and is listed in the second column on the same row.
<table>
<tr><th><a for=url>scheme</a>
<th><a for=url>port</a>
<tr><td>"<code>ftp</code>"<td>21
<tr><td>"<code>file</code>"<td>
<tr><td>"<code>gopher</code>"<td>70
<tr><td>"<code>http</code>"<td>80
<tr><td>"<code>https</code>"<td>443
<tr><td>"<code>ws</code>"<td>80
<tr><td>"<code>wss</code>"<td>443
</table>
<!-- The best reason I have for listing "gopher" is Apple/Google:
https://github.com/WebKit/webkit/blob/master/Source/WebCore/platform/URL.cpp#L72
https://code.google.com/p/google-url/source/browse/trunk/src/url_canon_stdurl.cc#120
It seems fine to remain compatible on that front, no need to support it
elsewhere though. -->
<p>A <a for=url>URL</a> <dfn>is special</dfn> if its <a for=url>scheme</a> is a
<a>special scheme</a>.
<p>A <dfn>local scheme</dfn> is a <a for=url>scheme</a> that is "<code>about</code>",
"<code>blob</code>", "<code>data</code>", or "<code>filesystem</code>".
<p>A <a for=url>URL</a> <dfn>is local</dfn> if its <a for=url>scheme</a> is a
<a>local scheme</a>.
<p class=note>This definition is used externally. E.g., by the Fetch Standard and
Referrer Policy. [[FETCH]] [[REFERRER-POLICY]]
<!-- And soonish CSP -->
<p>A <a for=url>URL</a> <dfn lt="include credentials">includes credentials</dfn> if either
its <a for=url>username</a> is not the empty string or its <a for=url>password</a> is
non-null.
<!-- used by Fetch -->
<p>A <a for=url>URL</a> can be designated as <dfn id=concept-base-url>base URL</dfn>.
<p class="note no-backref">A <a>base URL</a> is useful for the <a>URL parser</a> when the
input might be a <a>relative URL</a>.
<hr>
<p>To <dfn local-lt=pop>pop a <var>url</var>'s path</dfn>, if
<var>url</var>'s <a for=url>scheme</a> is not "<code>file</code>" or
<var>url</var>'s <a for=url>path</a> does not contain a single string that is a
<a>normalized Windows drive letter</a>, remove <var>url</var>'s <a for=url>path</a>'s
last string, if any.
<h3 id=url-syntax>URL syntax</h3>
<!-- http://tantek.com/2011/238/b1/many-ways-slice-url-name-pieces -->
<p>A <dfn export for=urlsyntax id=syntax-url lt="URL|URL string">URL</dfn> must be either
a <a>relative URL with fragment</a> or an <a>absolute URL with fragment</a>. To
disambiguate from a <a>URL record</a> it can also be referred to as a <a>URL string</a>.
<p>An
<dfn export for=urlsyntax id=syntax-url-absolute-with-fragment>absolute URL with fragment</dfn>
must be an <a>absolute URL</a>, followed by "<code>#</code>" and a
<a for=urlsyntax>fragment</a>.
<p>An <dfn export for=urlsyntax id=syntax-url-absolute>absolute URL</dfn> must be one of
the following
<ul class=brief>
<li><p>a <a for=urlsyntax>scheme</a> that is an <a spec=dom>ASCII case-insensitive</a>
match for a <a>special scheme</a> and not an <a spec=dom>ASCII case-insensitive</a> match
for "<code>file</code>", followed by "<code>:</code>" and a <a>scheme-relative URL</a>
<li><p>a <a for=urlsyntax>scheme</a> that is <em>not</em> an
<a spec=dom>ASCII case-insensitive</a> match for a <a>special scheme</a>, followed by
"<code>:</code>" and a <a>relative URL</a>
<li><p>a <a for=urlsyntax>scheme</a> that is an <a spec=dom>ASCII case-insensitive</a>
match for "<code>file</code>", followed by "<code>:</code>" and a
<a>scheme-relative file URL</a>
</ul>
<p>any optionally followed by "<code>?</code>" and a <a for=urlsyntax>query</a>.
<p>A <dfn export for=urlsyntax id=syntax-url-scheme>scheme</dfn> must be one
<a>ASCII alpha</a>, followed by zero or more of <a>ASCII alphanumeric</a>,
"<code>+</code>", "<code>-</code>", and "<code>.</code>". <a for=urlsyntax>Schemes</a>
should be registered in the <cite>IANA URI [sic] Schemes</cite> registry.
[[!IANA-URI-SCHEMES]]
[[RFC7595]]
<p>A
<dfn export for=urlsyntax id=syntax-url-relative-with-fragment>relative URL with fragment</dfn>
must be a <a>relative URL</a>, followed by "<code>#</code>" and a
<a for=urlsyntax>fragment</a>.
<p>A <dfn export for=urlsyntax id=syntax-url-relative>relative URL</dfn> must be one of
the following, switching on <a>base URL</a>'s <a for=url>scheme</a>:
<dl class=switch>
<dt>Not "<code>file</code>"
<dd><p>a <a>scheme-relative URL</a>
<dd><p>a <a>path-absolute URL</a>
<dd><p>a <a>path-relative scheme-less URL</a>
<dt>"<code>file</code>"
<dd><p>a <a>scheme-relative file URL</a>
<dd><p>a <a>path-absolute URL</a> if <a>base URL</a>'s <a for=url>host</a> is null
<dd><p>a <a>path-absolute non-Windows-file URL</a> if <a>base URL</a>'s
<a for=url>host</a> is non-null
<dd><p>a <a>path-relative scheme-less URL</a>
</dl>
<p>any optionally followed by "<code>?</code>" and a <a for=urlsyntax>query</a>.
<p class="note no-backref">A non-null <a>base URL</a> is necessary when
<a lt="URL parser">parsing</a> a <a>relative URL</a>.
<p>A <dfn export for=urlsyntax id=syntax-url-scheme-relative>scheme-relative URL</dfn>
must be "<code>//</code>", followed by a <a for=hostsyntax>host</a>, optionally followed
by "<code>:</code>" and a <a for=urlsyntax>port</a>, optionally followed by a
<a>path-absolute URL</a>.
<p>A <dfn export for=urlsyntax id=syntax-url-port>port</dfn> must be zero or more
<a>ASCII digits</a>.
<p>A
<dfn export for=urlsyntax id=syntax-url-file-scheme-relative>scheme-relative file URL</dfn>
must be "<code>//</code>", followed by one of the following
<ul class=brief>
<li><p>a <a for=hostsyntax>host</a>, optionally followed by a
<a>path-absolute non-Windows-file URL</a>
<li><p>a <a>path-absolute URL</a>.
</ul>
<p>A <dfn export for=urlsyntax id=syntax-url-path-absolute>path-absolute URL</dfn> must be
"<code>/</code>" followed by a <a>path-relative URL</a>.
<p>A