search

kenchris / urlpattern-polyfill

URLPattern polyfill
https://www.npmjs.com/package/urlpattern-polyfill
MIT License
268 stars 31 forks source link

restrict more forbidden hostname characters #43

Closed wanderview closed 2 years ago

wanderview commented 3 years ago

Currently the polyfill uses this code to restrict hostname characters:

https://github.com/kenchris/urlpattern-polyfill/blob/ad25d48b0857863ae0342bcdbc4578a4052a4e5b/src/url-utils.ts#L236

This is mostly correct, but its missing a few forbidden code points from the URL spec:

https://url.spec.whatwg.org/#forbidden-host-code-point

In particular, the space character is incorrectly allowed by the chromium URL parser and should be blocked in URLPattern. We are doing the same restriction in the c++ implementation in crbug.com/1248061 and are also adding WPT tests for this.