From e0c721b680d0977013ef2a14ba578388c01bd331 Mon Sep 17 00:00:00 2001 From: Anne van Kesteren Date: Mon, 15 Jun 2015 18:29:21 +0200 Subject: [PATCH] Make it non-conforming to place a username and/or password in a URL. Fixes https://www.w3.org/Bugs/Public/show_bug.cgi?id=27516 --- url.bs | 46 +++++++++++++--------------------------------- url.html | 56 ++++++++++++++++---------------------------------------- 2 files changed, 29 insertions(+), 73 deletions(-) diff --git a/url.bs b/url.bs index cc7455b2..c5926485 100644 --- a/url.bs +++ b/url.bs @@ -765,27 +765,9 @@ a query. parsed, a base URL must be in scope. -

A scheme-relative URL must be -"//", optionally followed by -userinfo and "@", -followed by a host, optionally followed -by ":" and a port, -optionally followed by an -absolute-path-relative URL. - -

Userinfo must be a -username, optionally followed by a -":" and a -password. - -

A username must be zero or more -URL units, excluding "/", -":, "?", and "@". - - -

A password must be zero or more -URL units, excluding "/", -"?", and "@". +

A scheme-relative URL must be +"//", followed by a host, optionally followed by ":" and +a port, optionally followed by an absolute-path-relative URL.

A port must be zero or more ASCII digits. @@ -859,6 +841,12 @@ U+100000 to U+10FFFD.

The URL units are URL code points and percent-encoded bytes. +

+ +

There is no valid way to express a +username or password within a +URL. +

URL parsing

@@ -1249,8 +1237,9 @@ optionally with an encoding

If c is "@", run these substeps:

    -

  1. If the @ flag is set, - parse error, prepend "%40" to +

  2. Parse error. + +

  3. If the @ flag is set, prepend "%40" to buffer.

  4. Set the @ flag. @@ -1259,16 +1248,7 @@ optionally with an encoding

    For each code point in buffer, run these substeps:

      -

    1. If code point is U+0009, U+000A, or U+000D, - parse error, continue. - -

    2. If code point is not a - URL code point and not - "%", parse error. - -

    3. If code point is "%" and - remaining does not start with two - ASCII hex digits, parse error. +

    4. If code point is U+0009, U+000A, or U+000D, continue.

    5. If code point is ":" and url's diff --git a/url.html b/url.html index c7d0673b..cf289403 100644 --- a/url.html +++ b/url.html @@ -1189,29 +1189,8 @@

      scheme-relative URL must be -"//", optionally followed by -userinfo and "@", -followed by a host, optionally followed -by ":" and a port, -optionally followed by an -absolute-path-relative URL. - -

      -

      Userinfo must be a -username, optionally followed by a -":" and a -password. - -

      -

      A username must be zero or more -URL units, excluding "/", -":, "?", and "@". - - -

      -

      A password must be zero or more -URL units, excluding "/", -"?", and "@". +"//", followed by a host, optionally followed by ":" and +a port, optionally followed by an absolute-path-relative URL.

      A port must be zero or more @@ -1293,6 +1272,14 @@

      URL units are URL code points and percent-encoded bytes. +

      +
      + + +

      There is no valid way to express a +username or password within a +URL. +

      4.2. URL parsing

      @@ -1875,8 +1862,11 @@

      parse error, prepend "%40" to +

      Parse error. + +

      +
    6. +

      If the @ flag is set, prepend "%40" to buffer.

      @@ -1892,20 +1882,7 @@

      parse error, continue. - -

      -
    7. -

      If code point is not a - URL code point and not - "%", parse error. - -

      -
    8. -

      If code point is "%" and - remaining does not start with two - ASCII hex digits, parse error. +

      If code point is U+0009, U+000A, or U+000D, continue.

    9. @@ -4502,7 +4479,6 @@

      URL serializer, 4.3
    10. URL units, 4.1
    11. URL(url, base), 6.1 -
    12. URL userinfo, 4.1
    13. URL username, 4
    14. URLUtils, 6
    15. URLUtils input, 6