Join GitHub today
GitHub is home to over 36 million developers working together to host and review code, manage projects, and build software together.Sign up
net/url: username in authority is not strictly in RFC3986 #22655
What version of Go are you using (
FWIW, node.js accepts this userinfo:
This is tricky behavior. I think it would be an undeniable bug if we would have parsed "evil.com" as the hostname instead of google.com. As is evident from slide 34 of https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf.
But we don't. And so does node and python.
Now if we follow the RFC to the letter, a
How about we just document this behavior ?
WDYT @bradfitz ?