net/url: func parse(rawURL string, viaRequest bool) (*URL, error)

[tibetsam]

What version of Go are you using (go version)?

go 1.21

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output

[$ go env](https://go.dev/play/)

What did you do?

https://go.dev/play/p/njAfwJZKrXZ

What did you expect to see?

https://www.rfc-editor.org/rfc/rfc1738.html
user = *[ uchar | ";" | "?" | "&" | "=" ]
password = *[ uchar | ";" | "?" | "&" | "=" ]

What did you see instead?

invalid port ":p" after host

[bcmills]

RFC 1738 defines:

uchar          = unreserved | escape

But : is in the reserved class — the opposite of unreserved. As far as I cal tell, the behavior of url.Parse in this case matches the RFC.

[tibetsam]

but it's an or operation
password = *[ uchar | ";" | "?" | "&" | "=" ]

[bcmills]

The character : is not in that list.

[tibetsam]

I think the problem comes along with character ?, not : please check code between line 531-536 https://github.com/golang/go/blob/master/src/net/url/url.go

…

On Thu 28. Sep 2023 at 19:18, Bryan C. Mills ***@***.***> wrote: The character : is not in that list. — Reply to this email directly, view it on GitHub <#63280 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADCD6BGC24J4LO5JOPAZQ43X4WWQBANCNFSM6AAAAAA5KSA3DU> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[seankhliao]

we use RFC 3986, not 1738
https://www.rfc-editor.org/rfc/rfc3986.html#section-3.2.1

[tibetsam]

thanks!