URI.merge/2 mangling the path

[feld]

Environment

Erlang/OTP 23 [erts-11.1.5] [source] [64-bit] [smp:8:8] [ds:8:8:10] [async-threads:1]
Elixir 1.10.4 (compiled with Erlang/OTP 21)

Synopsis

We have a rich media parser (OpenGraph, Twittercards, etc) which encountered an issue. The code discussed likely exists because some sites on the internet are providing relative URLs in their OGP/Twittercard metadata. We should do more validation before blindly merging, but this problem could still be encountered.

Current behavior

page_url = "https://www.macrumors.com/guide/apps-support-apples-spatial-audio-feature/"

image_url = "https://images.macrumors.com/t/4riJyi1XC906qyJ41nAfOgpvo1I=/1600x/https://images.macrumors.com/article-new/2020/09/spatialaudiofeature.jpg"

page_url_data = URI.parse(page_url)

image_url_data = URI.parse(image_url)

merged_data = URI.merge(page_url_data, image_url_data)

image_url_data.path == merged_data.path

false

Expected behavior

true

Conclusion

URL to the image was changed from:

https://images.macrumors.com/t/4riJyi1XC906qyJ41nAfOgpvo1I=/1600x/https://images.macrumors.com/article-new/2020/09/spatialaudiofeature.jpg

to

https://images.macrumors.com/t/4riJyi1XC906qyJ41nAfOgpvo1I=/1600x/https:/images.macrumors.com/article-new/2020/09/spatialaudiofeature.jpg

Note, there is a missing / in the https:// embedded in the URL's path

[TheFirstAvenger]

It looks like as part of the remove_dot_segments_from_path call, we split on "/", remove any empty segments, then rejoin with "/", which effectively eliminates any duplicated "/" values in the path:

https://github.com/elixir-lang/elixir/blob/master/lib/elixir/lib/uri.ex#L707-L712

https://github.com/elixir-lang/elixir/blob/master/lib/elixir/lib/uri.ex#L724-L727