New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 809852 link

Starred by 2 users

Issue metadata

Status: Available
Owner: ----
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows , Chrome , Mac , Fuchsia
Pri: 3
Type: Bug



Sign in to add a comment

Non-special URLs do not encode any characters above U+001F [Spec compat]

Project Member Reported by mgiuca@chromium.org, Feb 7 2018

Issue description

Chrome Version: 64.0.3282.140
OS: Linux (but presumably all)

What steps will reproduce the problem?
(1) Open console.
(2) new URL('web+custom: !"$%&\'()*+,-./0123456789:;<=>@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f').pathname

What is the expected result?
"%20!%22$%&'()*+,-./0123456789:;%3C=%3E@ABCDEFGHIJKLMNOPQRSTUVWXYZ[/]%5E_%60abcdefghijklmnopqrstuvwxyz%7B%7C%7D~%7F"

What happens instead?
" !"$%&'()*+,-./0123456789:;<=>@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f"

The characters SPACE, "<>^`{|} and U+007F should be escaped, as per the URL Standard [1] and the way that Chrome normally encodes the path segment. None of these characters are being escaped when it is a "non-special" URL (i.e., not http or another common web URL scheme). Note that C0 controls (U+0000 to U+001F) are escaped correctly. It's concerning that U+007F is not escaped correctly.

While the URL standard does make a number of distinctions for special vs non-special URLs, this is not one of them. Firefox correctly escapes SPACE and U+007F, but not the others.

[1] https://url.spec.whatwg.org/#path-percent-encode-set
 
Summary: Non-special URLs do not encode any characters above U+001F [Spec compat] (was: Non-special URLs do not encode any characters above U+001F)
Note: This also affects the GURL constructor (which, I assume, is independent of whatever implementation drives the JavaScript URL constructor).

Sign in to add a comment