Intent to Ship: [URL] Allow "%00" as a valid URL path

[Hayato Ito]

Contact emails

hay...@chromium.org

Specification

https://url.spec.whatwg.org

Summary

The context: This is a part of the URL interop 2023. Please see the CL's description [1] for more details. A reviewer recommended sending I2S [2] for this change. There was also a discussion regarding a potential risk [3].

--

Chrome currently considers a URL invalid if the URL's path part contains "%00" (or null), which is not compliant with the URL Standard [4]. For example, the following test fails in Chrome because `new URL(..)` throws an Invalid URL exception. assertEquals(new URL("http://example.com/%00").pathname, "/%00"); According to the URL Standard, any character or byte sequence in URL path should not make the URL invalid. Note: In other parts of URL, "%00" may still be considered invalid. For example, new URL("http://example%00.com/"); throws an exception because "%00" is not a valid host codepoint.

- [1] https://crrev.com/c/4596360
- [2] https://crrev.com/c/4596360/comments/07cdcc45_545df600
- [3] https://crrev.com/c/4596360/comments/07c373bd_74564864?tab=comments
- [4] https://url.spec.whatwg.org/

Blink component

Blink>Network

TAG review

None

TAG review status

Not applicable

Risks

Interoperability and Compatibility

Gecko: Shipped

WebKit: Shipped

Will this feature be supported on all six Blink platforms (Windows, Mac, Linux, Chrome OS, Android, and Android WebView)?

Yes

Is this feature fully tested by web-platform-tests?

Yes

Tracking bug

https://bugs.chromium.org/p/chromium/issues/detail?id=1400251

Estimated milestones

Shipping on desktop

117

Link to entry on the Chrome Platform Status

https://chromestatus.com/feature/4763113357836288

--

Hayato

[Daniel Bratell]

It is a small change, but I understand why everyone wants an extra pair of eyes on it. Unexpected embedded null bytes have broken various programs in the past. On the other hand, I don't consider that to be a blocker for API OWNER shipping decisions, and if the other browsers have implemented it successfully and your reviewers seem reasonably confident it will work out fine, we should just make sure we're all compatible:

LGTM1

/Daniel

--
You received this message because you are subscribed to the Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAFpjS_2QN_6E_ianHrUVi%3DcR1J1x-nnmEg4N-A1t_jx8xwL9FA%40mail.gmail.com.

[Von Johnson]

Let me first say how much I appreciate you following up with me. I've been trouble shooting must of the day, and no one other than you took time to respond. You are awesome. My main focus is to receive messages via text, but chrome and play store was literally over 200gb in data, which doesn't make my text messages app a priority. Do you think it's my play service. It freezes contently. See pic attached. Who AWS-3

To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/badb0c43-3bc8-95ea-72fe-278f905831bb%40gmail.com.

[Rick Byers]

Agreed this is bugfix level and not "an API change". Of course bug fixes can also trigger compat issues, but it seems very unlikely to me that anyone could reasonably depend on chromium failing to parse a URL of this obscure form (when other engines don't).  LGTM2

To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/badb0c43-3bc8-95ea-72fe-278f905831bb%40gmail.com.

[Yoav Weiss]

LGTM3. As this is a change that will not break any URLs (but enable ones that are currently broken in Chromium but not elsewhere), the compat risk seems negligible and interop risk negative (== interop benefits).

To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAFUtAY9ZD46H%3DSkOgTgJ1D-cYqo-qiiwPwxASvHLQ9%2BbeNs73w%40mail.gmail.com.