net/url: pathologically silly URL parsing fails

[cwedgwood]

What version of Go are you using (go version)?

1.18 though tip

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

n/a

What did you do?

https://go.dev/play/p/63z_YnaE4vw?v=gotip

package main

import (
	"fmt"
	"net/url"
)

func main() {
	// https://twitter.com/bagder/status/1567162794092404742
	ickyUrl := `http://http://http://@http://http://?http://#http://`
	u, _ := url.Parse(ickyUrl)
	fmt.Printf("User: %v\n", u.User)
	fmt.Printf("Path: %v\n", u.Path)
}

What did you expect to see?

(this should be sanity checked, i might be reading things wrong)

User: http://http:// 
Path: http://http://

What did you see instead?

User: 
Path: //http://@http://http://

I noticed some more talk about what is correct later on: https://twitter.com/mtrantalainen/status/1567187061202878465

This is quirky enough it's not clear what the safe (not necessarily correct) thing should be. Perhaps nothing.

[seankhliao]

From RFC 3986 Section 3.2

The authority component is preceded by a double slash ("//") and is
terminated by the next slash ("/"), question mark ("?"), or number
sign ("#") character, or by the end of the URI.

The WHATWG parser also doesn't think / is valid there: https://url.spec.whatwg.org/#authority-state

Closing as this appears to be working as intended.