Salta al contenuto
0
  • Categorie
  • Recenti
  • Tag
  • Popolare
  • Mondo
  • Utenti
  • Gruppi
  • Categorie
  • Recenti
  • Tag
  • Popolare
  • Mondo
  • Utenti
  • Gruppi
Collassa

Forum Federato

Di Piero Bosio
  1. Home
  2. Categorie
  3. Senza categoria
  4. Having ongoing discussions about URL parsing differences as a basis for a #curl security vulnerability report made me check when I wrote my "my URL isn't your URL" blog post.

Having ongoing discussions about URL parsing differences as a basis for a #curl security vulnerability report made me check when I wrote my "my URL isn't your URL" blog post.

Pianificato Fissato Bloccato Spostato Senza categoria
curl
14 Post 5 Autori 2 Visualizzazioni
  • Da Vecchi a Nuovi
  • Da Nuovi a Vecchi
  • Più Voti
Rispondi
  • Topic risposta
Effettua l'accesso per rispondere
Questa discussione è stata eliminata. Solo gli utenti con diritti di gestione possono vederla.
  • daniel:// stenberg://undefined daniel:// stenberg://

    Having ongoing discussions about URL parsing differences as a basis for a #curl security vulnerability report made me check when I wrote my "my URL isn't your URL" blog post.

    *Nine years ago*. And we have not made a single move towards a solution in all this time.

    https://daniel.haxx.se/blog/2016/05/11/my-url-isnt-your-url/

    daniel:// stenberg://undefined Questo utente è esterno a questo forum
    daniel:// stenberg://undefined Questo utente è esterno a questo forum
    daniel:// stenberg://
    scritto su ultima modifica di
    #2

    I've said it before. The WHATWG won't fix this because they are happy with a spec that works for them and they don't care about URLs for the rest of the world.

    The IETF has given up the topic, partly I think because WHATWG already has stated that they run their own race and making a unified spec that works would be next to impossible.

    Jean-Baptiste "JBQ" Quéruundefined 1 Risposta Ultima Risposta
    1
    • daniel:// stenberg://undefined daniel:// stenberg://

      I've said it before. The WHATWG won't fix this because they are happy with a spec that works for them and they don't care about URLs for the rest of the world.

      The IETF has given up the topic, partly I think because WHATWG already has stated that they run their own race and making a unified spec that works would be next to impossible.

      Jean-Baptiste "JBQ" Quéruundefined Questo utente è esterno a questo forum
      Jean-Baptiste "JBQ" Quéruundefined Questo utente è esterno a questo forum
      Jean-Baptiste "JBQ" Quéru
      scritto su ultima modifica di
      #3

      @bagder My perception of WHATWG (as a traumatized but recovering browser engineer) is that they aren't / weren't issuing specifications, they are / were issuing documentation (for existing behaviors).

      The distinction is important, because, when implementation and specifications disagree, the implementation is wrong; however, when implementation and documentation disagree, the documentation is wrong.

      daniel:// stenberg://undefined 1 Risposta Ultima Risposta
      1
      • Jean-Baptiste "JBQ" Quéruundefined Jean-Baptiste "JBQ" Quéru

        @bagder My perception of WHATWG (as a traumatized but recovering browser engineer) is that they aren't / weren't issuing specifications, they are / were issuing documentation (for existing behaviors).

        The distinction is important, because, when implementation and specifications disagree, the implementation is wrong; however, when implementation and documentation disagree, the documentation is wrong.

        daniel:// stenberg://undefined Questo utente è esterno a questo forum
        daniel:// stenberg://undefined Questo utente è esterno a questo forum
        daniel:// stenberg://
        scritto su ultima modifica di
        #4

        @jbqueru I've been told in discussions with WHATWG people that their specs (they call them specs) are both: documents how browsers work and they say how browsers should work. When I've pointed out discrepancies in the past (browsers that didn't follow their spec), the answer have usually been that it will be fixed in a future browser release and that the spec is right.

        Jean-Baptiste "JBQ" Quéruundefined 1 Risposta Ultima Risposta
        • daniel:// stenberg://undefined daniel:// stenberg://

          @jbqueru I've been told in discussions with WHATWG people that their specs (they call them specs) are both: documents how browsers work and they say how browsers should work. When I've pointed out discrepancies in the past (browsers that didn't follow their spec), the answer have usually been that it will be fixed in a future browser release and that the spec is right.

          Jean-Baptiste "JBQ" Quéruundefined Questo utente è esterno a questo forum
          Jean-Baptiste "JBQ" Quéruundefined Questo utente è esterno a questo forum
          Jean-Baptiste "JBQ" Quéru
          scritto su ultima modifica di
          #5

          @bagder That's been my experience as well.

          I personally disagree with the approach, because the so-called "spec" ends up ossifying the behavior of a prototype, instead of learning from it and creating a cleaner spec. WHATWG doesn't learn from mistakes or fix them, it propagates and perpetuates mistakes.

          Suzanne Aldrich (she/her)undefined 1 Risposta Ultima Risposta
          • Jean-Baptiste "JBQ" Quéruundefined Jean-Baptiste "JBQ" Quéru

            @bagder That's been my experience as well.

            I personally disagree with the approach, because the so-called "spec" ends up ossifying the behavior of a prototype, instead of learning from it and creating a cleaner spec. WHATWG doesn't learn from mistakes or fix them, it propagates and perpetuates mistakes.

            Suzanne Aldrich (she/her)undefined Questo utente è esterno a questo forum
            Suzanne Aldrich (she/her)undefined Questo utente è esterno a questo forum
            Suzanne Aldrich (she/her)
            scritto su ultima modifica di
            #6

            @jbqueru @bagder well then. that's not engineering. that's hoarding behavior.

            daniel:// stenberg://undefined 1 Risposta Ultima Risposta
            • Suzanne Aldrich (she/her)undefined Suzanne Aldrich (she/her)

              @jbqueru @bagder well then. that's not engineering. that's hoarding behavior.

              daniel:// stenberg://undefined Questo utente è esterno a questo forum
              daniel:// stenberg://undefined Questo utente è esterno a questo forum
              daniel:// stenberg://
              scritto su ultima modifica di
              #7

              @suzannealdrich @jbqueru and its impossible to be perfectly compliant because then suddenly the "spec" changes and you're not anymore. Not a way to build things like URLs that are supposed to in theory be possible to outlive us all.

              Peter Bindelsundefined Erin 💽✨undefined 2 Risposte Ultima Risposta
              • daniel:// stenberg://undefined daniel:// stenberg://

                @suzannealdrich @jbqueru and its impossible to be perfectly compliant because then suddenly the "spec" changes and you're not anymore. Not a way to build things like URLs that are supposed to in theory be possible to outlive us all.

                Peter Bindelsundefined Questo utente è esterno a questo forum
                Peter Bindelsundefined Questo utente è esterno a questo forum
                Peter Bindels
                scritto su ultima modifica di
                #8

                @bagder @suzannealdrich @jbqueru

                I know I'm coming at URL parsing from a clean brain, but can't we specify the base things in an actually parseable way? Surely it's not *that* hard to parse a URL?

                daniel:// stenberg://undefined 1 Risposta Ultima Risposta
                • Peter Bindelsundefined Peter Bindels

                  @bagder @suzannealdrich @jbqueru

                  I know I'm coming at URL parsing from a clean brain, but can't we specify the base things in an actually parseable way? Surely it's not *that* hard to parse a URL?

                  daniel:// stenberg://undefined Questo utente è esterno a questo forum
                  daniel:// stenberg://undefined Questo utente è esterno a questo forum
                  daniel:// stenberg://
                  scritto su ultima modifica di
                  #9

                  @dascandy @suzannealdrich @jbqueru we could theoretically do that, sure.

                  Peter Bindelsundefined 1 Risposta Ultima Risposta
                  • daniel:// stenberg://undefined daniel:// stenberg://

                    @dascandy @suzannealdrich @jbqueru we could theoretically do that, sure.

                    Peter Bindelsundefined Questo utente è esterno a questo forum
                    Peter Bindelsundefined Questo utente è esterno a questo forum
                    Peter Bindels
                    scritto su ultima modifica di
                    #10

                    @bagder @suzannealdrich @jbqueru

                    Taking a stab in the dark with some EBNF:

                    url ::= protocol '://' [ name [ ':' name ] '@' ] [ server ] [ '/' [ path ] [ '?' arg { '&' arg } ] ]
                    protocol ::= name
                    server ::= name { '.' name }
                    path ::= name { '/' name }
                    arg ::= name [ '=' name ]

                    name = ([^:/@?&=.%]|%[0-9a-f][0-9a-f])+

                    I understand that whatwg makes that :// not a required part ... but this kinda matches what my naive brain thinks of as a URL and how to read it.

                    daniel:// stenberg://undefined 1 Risposta Ultima Risposta
                    • Peter Bindelsundefined Peter Bindels

                      @bagder @suzannealdrich @jbqueru

                      Taking a stab in the dark with some EBNF:

                      url ::= protocol '://' [ name [ ':' name ] '@' ] [ server ] [ '/' [ path ] [ '?' arg { '&' arg } ] ]
                      protocol ::= name
                      server ::= name { '.' name }
                      path ::= name { '/' name }
                      arg ::= name [ '=' name ]

                      name = ([^:/@?&=.%]|%[0-9a-f][0-9a-f])+

                      I understand that whatwg makes that :// not a required part ... but this kinda matches what my naive brain thinks of as a URL and how to read it.

                      daniel:// stenberg://undefined Questo utente è esterno a questo forum
                      daniel:// stenberg://undefined Questo utente è esterno a questo forum
                      daniel:// stenberg://
                      scritto su ultima modifica di
                      #11

                      @dascandy @suzannealdrich @jbqueru add port numbers, IP addresses (v4, v6, zone id?), add options? How about IDN?

                      I see you used two slashes, but URIs actually don't have that. Many have no slashes at all.

                      But sure, everything *could* be written down in a spec. Getting the world to agree with that spec though: not so easy.

                      Peter Bindelsundefined 1 Risposta Ultima Risposta
                      • daniel:// stenberg://undefined daniel:// stenberg://

                        @dascandy @suzannealdrich @jbqueru add port numbers, IP addresses (v4, v6, zone id?), add options? How about IDN?

                        I see you used two slashes, but URIs actually don't have that. Many have no slashes at all.

                        But sure, everything *could* be written down in a spec. Getting the world to agree with that spec though: not so easy.

                        Peter Bindelsundefined Questo utente è esterno a questo forum
                        Peter Bindelsundefined Questo utente è esterno a questo forum
                        Peter Bindels
                        scritto su ultima modifica di
                        #12

                        @bagder @suzannealdrich @jbqueru

                        If Curl and Firefox start by advocating "this is the spec for URIs, and other things might work or might not" that would already be a good start for the free internet.

                        Then we only have Chromium to convince, and the rest follows implicitly.

                        daniel:// stenberg://undefined 1 Risposta Ultima Risposta
                        • Peter Bindelsundefined Peter Bindels

                          @bagder @suzannealdrich @jbqueru

                          If Curl and Firefox start by advocating "this is the spec for URIs, and other things might work or might not" that would already be a good start for the free internet.

                          Then we only have Chromium to convince, and the rest follows implicitly.

                          daniel:// stenberg://undefined Questo utente è esterno a questo forum
                          daniel:// stenberg://undefined Questo utente è esterno a questo forum
                          daniel:// stenberg://
                          scritto su ultima modifica di
                          #13

                          @dascandy @suzannealdrich @jbqueru I'm sorry but already while I worked at Mozilla and Firefox my colleagues were in team WHATWG and I'm pretty sure they still are.

                          And doing a standard for URLs without having the super powers involved and interested is obviously not going to make a successful spec

                          1 Risposta Ultima Risposta
                          1
                          • daniel:// stenberg://undefined daniel:// stenberg://

                            @suzannealdrich @jbqueru and its impossible to be perfectly compliant because then suddenly the "spec" changes and you're not anymore. Not a way to build things like URLs that are supposed to in theory be possible to outlive us all.

                            Erin 💽✨undefined Questo utente è esterno a questo forum
                            Erin 💽✨undefined Questo utente è esterno a questo forum
                            Erin 💽✨
                            scritto su ultima modifica di
                            #14

                            @bagder @suzannealdrich @jbqueru also I note from your post that you find the WHATWG URL spec hard to read but I have to say that in general I find all WHATWG specifications nigh-unreadable

                            English but precisely defined pseudocode has to be one of the worst possible ways to write a specification

                            1 Risposta Ultima Risposta
                            1
                            • Oblomovundefined Oblomov ha condiviso questa discussione
                            Rispondi
                            • Topic risposta
                            Effettua l'accesso per rispondere
                            • Da Vecchi a Nuovi
                            • Da Nuovi a Vecchi
                            • Più Voti


                            • Accedi

                            • Accedi o registrati per effettuare la ricerca.
                            • Primo post
                              Ultimo post