net.SplitHostPort("[hostname]:port") returns ("hostname", "port", nil).
The bracketed name syntax exists to disambiguate colons in IPv6 addresses from the colon separating the port from the address. In the specific case of URL host components, RFC 3986 permits the brackets to only contain an IPv6 address. In cases such as #78944, naïvely using SplitHostPort on a URL host component can lead to inadvertently accepting technically-invalid addresses.
Perhaps we should change net.SplitHostPort to reject anything other than IPv6 addresses in the brackets. (We'd almost certainly need a GODEBUG to revert to the old behavior.) Or perhaps we should have a stricter url.SplitHostPort for use on URL host components. Or perhaps this is fine. Filing this issue to track.
net.SplitHostPort("[hostname]:port")returns("hostname", "port", nil).The bracketed name syntax exists to disambiguate colons in IPv6 addresses from the colon separating the port from the address. In the specific case of URL host components, RFC 3986 permits the brackets to only contain an IPv6 address. In cases such as #78944, naïvely using
SplitHostPorton a URL host component can lead to inadvertently accepting technically-invalid addresses.Perhaps we should change
net.SplitHostPortto reject anything other than IPv6 addresses in the brackets. (We'd almost certainly need a GODEBUG to revert to the old behavior.) Or perhaps we should have a stricterurl.SplitHostPortfor use on URL host components. Or perhaps this is fine. Filing this issue to track.