net/url: userinfo.String() return unexpect url when the username is null string

[guanyux]

What version of Go are you using (go version)?

$ go version
go version go1.16.4 darwin/amd64

Does this issue reproduce with the latest release?

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/guanyuding/Library/Caches/go-build"
GOENV="/Users/guanyuding/Library/Application Support/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOINSECURE=""
GOMODCACHE="/Users/guanyuding/workspace/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="darwin"
GOPATH="/Users/guanyuding/workspace"
GOPRIVATE=""
GOPROXY="https://goproxy.io,direct"
GOROOT="/Users/guanyuding/go.1.16.4"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/Users/guanyuding/go.1.16.4/pkg/tool/darwin_amd64"
GOVCS=""
GOVERSION="go1.16.4"
GCCGO="gccgo"
AR="ar"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD="/dev/null"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -arch x86_64 -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/5r/yzy1rx4154b9zcz88p4lzmd00000gn/T/go-build2377834471=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

I want to access github api with token like this:

u, err := url.Parse(repo.Addr) // get url
u.User = url.UserPassword(repo.User, repo.Token)
return u.String()

unexpectedly I found that there is an extra colon in the url like this:
"https://:ghp_snNcRtoWc6Uy5Vxxxxxxx@github.com/tf-xxx/tfxxx.git/"

So I review source code about the String() in net/url/url.go , It will return unexpect url when the username is null string.

s := escape(u.username, encodeUserPassword)
if u.passwordSet {
	s += ":" + escape(u.password, encodeUserPassword)
}

What did you expect to see?

I expect that Userinfo.String() function could return correct string when username is null string.

// String returns the encoded userinfo information in the standard form
// of "username[:password]".
func (u *Userinfo) String() string {
	if u == nil {
		return ""
	}
	s := escape(u.username, encodeUserPassword)
	if u.passwordSet {
		**s += ":" + escape(u.password, encodeUserPassword)**
	}
	return s
}

What did you see instead?

[seankhliao]

From RFC 3986, and the documentation the username is required while the password is optional. The colon separates the empty username from the password.

Closing as working as intended.

[guanyux]

@seankhliao Thanks for your reply, I found there is a code logic problem that I should use url.User instead of url.UserPassword in this case .