Please confirm with nick@ before landing a change here, since he did a lot of security work on blob URLs recently.

nick: Are you also familiar with filesystem URLs? I'm wondering why filesystem is marked as SCHEME_WITHOUT_AUTHORITY in kStandardURLSchemes, given that filesystem URLs always have an associated origin (test page: http://meacer.com/filesystem.html).

I'm fairly familiar with both blob and filesystem.

blobs URLS have inner origins (which GURL, outside of the url::Origin code, doesn't really recognize), and filesystem URLs have inner URLs (which GURL does parse into an inner_url() member).

My understanding of rfc3986 -- which may well be incorrect -- was that these inner origins / inner urls weren't authorities, but, they had authorities inside of them (since they embed standard schemes).

Or put differently: you can't parse the authority out of a blob or filesystem URLs the same way you can an http, https, chrome, or chrome-extension URL.

I'm generally in support of efforts to have GURL do more canonicalization of blob URLs. I think SCHEME_WITHOUT_AUTHORITY is probably appropriate for blobs, but it's not 100% clear to me quite what SCHEME_WITHOUT_AUTHORITY actually means.