Public urlutils and check type in set_scheme

[valenting]

Make urlutils public and disallow changing the scheme type to an incompatible type

[SimonSapin]

I’m not sure about disallowing the changes. In the test case below, no two of the browsers tested are interoperable but they all do change the scheme:

http://software.hixie.ch/utilities/js/live-dom-viewer/?saved=3428

<a href="mailto:a@b.net">
<script>
var a = document.body.firstChild; 
console.log(a.href);
a.protocol = "http";
console.log(a.href)
</script>

In Chromium:

log: mailto:a@b.net
log: http://a@b.net/

In old Opera (Presto):

log: mailto:a@b.net
log: http:///a@b.net

In Firefox:

log: mailto:a@b.net
log: http://software.hixie.ch/utilities/js/live-dom-viewer/a@b.net

[valenting]

One of the ssues we've had in Firefox is setters that make the URL go into an invalid state.
For example:

#[test]
fn change_protocol() {
    let mut url = Url::parse("file:///[:::_1]/abc.html").unwrap(); // valid file path, but invalid hostname
    {
        let mut wrapper = UrlUtilsWrapper { url: &mut url, parser: &UrlParser::new()};
        wrapper.set_scheme("http");
    }
    let result = Url::parse(&url.serialize()).unwrap().serialize();
}

There are probably hundreds of these examples. Sometimes harmless, sometimes a big security risk. IMO the only way of safely changing the scheme is enforcing they the same type.

PS. there are things we don't allow in Firefox. Like this:

var url = new URL("http://example.com");
url.protocol = "data"; // this does nothing

[SimonSapin]

I’ve filed https://www.w3.org/Bugs/Public/show_bug.cgi?id=28091 on the spec about this.

[SimonSapin]

Ok, in the spec, a "relative flag" is maintained separately from the scheme. So in this test case, you’d end up with an URL in the http scheme but that is still a non-relative URL. What do you think?

[valenting]

We could also reparse the url after setting the scheme, and roll it back if that fails.
I think that would work.

[SimonSapin]

Ideally we’d do what the spec says, and if that’s not good we should convince Anne to change the spec.

[SimonSapin]

Alright, let's take this for now. I filed #85 about this issue, if we want to revsisit later.