Salta al contenuto
0
  • Categorie
  • Recenti
  • Tag
  • Popolare
  • Mondo
  • Utenti
  • Gruppi
  • Categorie
  • Recenti
  • Tag
  • Popolare
  • Mondo
  • Utenti
  • Gruppi
Collassa

Forum Federato

Di Piero Bosio
  1. Home
  2. Categorie
  3. Senza categoria
  4. Having ongoing discussions about URL parsing differences as a basis for a #curl security vulnerability report made me check when I wrote my "my URL isn't your URL" blog post.

Having ongoing discussions about URL parsing differences as a basis for a #curl security vulnerability report made me check when I wrote my "my URL isn't your URL" blog post.

Pianificato Fissato Bloccato Spostato Senza categoria
curl
14 Post 5 Autori 2 Visualizzazioni
  • Da Vecchi a Nuovi
  • Da Nuovi a Vecchi
  • Più Voti
Rispondi
  • Topic risposta
Effettua l'accesso per rispondere
Questa discussione è stata eliminata. Solo gli utenti con diritti di gestione possono vederla.
  • daniel:// stenberg://undefined daniel:// stenberg://

    I've said it before. The WHATWG won't fix this because they are happy with a spec that works for them and they don't care about URLs for the rest of the world.

    The IETF has given up the topic, partly I think because WHATWG already has stated that they run their own race and making a unified spec that works would be next to impossible.

    Jean-Baptiste "JBQ" Quéruundefined Questo utente è esterno a questo forum
    Jean-Baptiste "JBQ" Quéruundefined Questo utente è esterno a questo forum
    Jean-Baptiste "JBQ" Quéru
    scritto su ultima modifica di
    #3

    @bagder My perception of WHATWG (as a traumatized but recovering browser engineer) is that they aren't / weren't issuing specifications, they are / were issuing documentation (for existing behaviors).

    The distinction is important, because, when implementation and specifications disagree, the implementation is wrong; however, when implementation and documentation disagree, the documentation is wrong.

    daniel:// stenberg://undefined 1 Risposta Ultima Risposta
    1
    • Jean-Baptiste "JBQ" Quéruundefined Jean-Baptiste "JBQ" Quéru

      @bagder My perception of WHATWG (as a traumatized but recovering browser engineer) is that they aren't / weren't issuing specifications, they are / were issuing documentation (for existing behaviors).

      The distinction is important, because, when implementation and specifications disagree, the implementation is wrong; however, when implementation and documentation disagree, the documentation is wrong.

      daniel:// stenberg://undefined Questo utente è esterno a questo forum
      daniel:// stenberg://undefined Questo utente è esterno a questo forum
      daniel:// stenberg://
      scritto su ultima modifica di
      #4

      @jbqueru I've been told in discussions with WHATWG people that their specs (they call them specs) are both: documents how browsers work and they say how browsers should work. When I've pointed out discrepancies in the past (browsers that didn't follow their spec), the answer have usually been that it will be fixed in a future browser release and that the spec is right.

      Jean-Baptiste "JBQ" Quéruundefined 1 Risposta Ultima Risposta
      • daniel:// stenberg://undefined daniel:// stenberg://

        @jbqueru I've been told in discussions with WHATWG people that their specs (they call them specs) are both: documents how browsers work and they say how browsers should work. When I've pointed out discrepancies in the past (browsers that didn't follow their spec), the answer have usually been that it will be fixed in a future browser release and that the spec is right.

        Jean-Baptiste "JBQ" Quéruundefined Questo utente è esterno a questo forum
        Jean-Baptiste "JBQ" Quéruundefined Questo utente è esterno a questo forum
        Jean-Baptiste "JBQ" Quéru
        scritto su ultima modifica di
        #5

        @bagder That's been my experience as well.

        I personally disagree with the approach, because the so-called "spec" ends up ossifying the behavior of a prototype, instead of learning from it and creating a cleaner spec. WHATWG doesn't learn from mistakes or fix them, it propagates and perpetuates mistakes.

        Suzanne Aldrich (she/her)undefined 1 Risposta Ultima Risposta
        • Jean-Baptiste "JBQ" Quéruundefined Jean-Baptiste "JBQ" Quéru

          @bagder That's been my experience as well.

          I personally disagree with the approach, because the so-called "spec" ends up ossifying the behavior of a prototype, instead of learning from it and creating a cleaner spec. WHATWG doesn't learn from mistakes or fix them, it propagates and perpetuates mistakes.

          Suzanne Aldrich (she/her)undefined Questo utente è esterno a questo forum
          Suzanne Aldrich (she/her)undefined Questo utente è esterno a questo forum
          Suzanne Aldrich (she/her)
          scritto su ultima modifica di
          #6

          @jbqueru @bagder well then. that's not engineering. that's hoarding behavior.

          daniel:// stenberg://undefined 1 Risposta Ultima Risposta
          • Suzanne Aldrich (she/her)undefined Suzanne Aldrich (she/her)

            @jbqueru @bagder well then. that's not engineering. that's hoarding behavior.

            daniel:// stenberg://undefined Questo utente è esterno a questo forum
            daniel:// stenberg://undefined Questo utente è esterno a questo forum
            daniel:// stenberg://
            scritto su ultima modifica di
            #7

            @suzannealdrich @jbqueru and its impossible to be perfectly compliant because then suddenly the "spec" changes and you're not anymore. Not a way to build things like URLs that are supposed to in theory be possible to outlive us all.

            Peter Bindelsundefined Erin 💽✨undefined 2 Risposte Ultima Risposta
            • daniel:// stenberg://undefined daniel:// stenberg://

              @suzannealdrich @jbqueru and its impossible to be perfectly compliant because then suddenly the "spec" changes and you're not anymore. Not a way to build things like URLs that are supposed to in theory be possible to outlive us all.

              Peter Bindelsundefined Questo utente è esterno a questo forum
              Peter Bindelsundefined Questo utente è esterno a questo forum
              Peter Bindels
              scritto su ultima modifica di
              #8

              @bagder @suzannealdrich @jbqueru

              I know I'm coming at URL parsing from a clean brain, but can't we specify the base things in an actually parseable way? Surely it's not *that* hard to parse a URL?

              daniel:// stenberg://undefined 1 Risposta Ultima Risposta
              • Peter Bindelsundefined Peter Bindels

                @bagder @suzannealdrich @jbqueru

                I know I'm coming at URL parsing from a clean brain, but can't we specify the base things in an actually parseable way? Surely it's not *that* hard to parse a URL?

                daniel:// stenberg://undefined Questo utente è esterno a questo forum
                daniel:// stenberg://undefined Questo utente è esterno a questo forum
                daniel:// stenberg://
                scritto su ultima modifica di
                #9

                @dascandy @suzannealdrich @jbqueru we could theoretically do that, sure.

                Peter Bindelsundefined 1 Risposta Ultima Risposta
                • daniel:// stenberg://undefined daniel:// stenberg://

                  @dascandy @suzannealdrich @jbqueru we could theoretically do that, sure.

                  Peter Bindelsundefined Questo utente è esterno a questo forum
                  Peter Bindelsundefined Questo utente è esterno a questo forum
                  Peter Bindels
                  scritto su ultima modifica di
                  #10

                  @bagder @suzannealdrich @jbqueru

                  Taking a stab in the dark with some EBNF:

                  url ::= protocol '://' [ name [ ':' name ] '@' ] [ server ] [ '/' [ path ] [ '?' arg { '&' arg } ] ]
                  protocol ::= name
                  server ::= name { '.' name }
                  path ::= name { '/' name }
                  arg ::= name [ '=' name ]

                  name = ([^:/@?&=.%]|%[0-9a-f][0-9a-f])+

                  I understand that whatwg makes that :// not a required part ... but this kinda matches what my naive brain thinks of as a URL and how to read it.

                  daniel:// stenberg://undefined 1 Risposta Ultima Risposta
                  • Peter Bindelsundefined Peter Bindels

                    @bagder @suzannealdrich @jbqueru

                    Taking a stab in the dark with some EBNF:

                    url ::= protocol '://' [ name [ ':' name ] '@' ] [ server ] [ '/' [ path ] [ '?' arg { '&' arg } ] ]
                    protocol ::= name
                    server ::= name { '.' name }
                    path ::= name { '/' name }
                    arg ::= name [ '=' name ]

                    name = ([^:/@?&=.%]|%[0-9a-f][0-9a-f])+

                    I understand that whatwg makes that :// not a required part ... but this kinda matches what my naive brain thinks of as a URL and how to read it.

                    daniel:// stenberg://undefined Questo utente è esterno a questo forum
                    daniel:// stenberg://undefined Questo utente è esterno a questo forum
                    daniel:// stenberg://
                    scritto su ultima modifica di
                    #11

                    @dascandy @suzannealdrich @jbqueru add port numbers, IP addresses (v4, v6, zone id?), add options? How about IDN?

                    I see you used two slashes, but URIs actually don't have that. Many have no slashes at all.

                    But sure, everything *could* be written down in a spec. Getting the world to agree with that spec though: not so easy.

                    Peter Bindelsundefined 1 Risposta Ultima Risposta
                    • daniel:// stenberg://undefined daniel:// stenberg://

                      @dascandy @suzannealdrich @jbqueru add port numbers, IP addresses (v4, v6, zone id?), add options? How about IDN?

                      I see you used two slashes, but URIs actually don't have that. Many have no slashes at all.

                      But sure, everything *could* be written down in a spec. Getting the world to agree with that spec though: not so easy.

                      Peter Bindelsundefined Questo utente è esterno a questo forum
                      Peter Bindelsundefined Questo utente è esterno a questo forum
                      Peter Bindels
                      scritto su ultima modifica di
                      #12

                      @bagder @suzannealdrich @jbqueru

                      If Curl and Firefox start by advocating "this is the spec for URIs, and other things might work or might not" that would already be a good start for the free internet.

                      Then we only have Chromium to convince, and the rest follows implicitly.

                      daniel:// stenberg://undefined 1 Risposta Ultima Risposta
                      • Peter Bindelsundefined Peter Bindels

                        @bagder @suzannealdrich @jbqueru

                        If Curl and Firefox start by advocating "this is the spec for URIs, and other things might work or might not" that would already be a good start for the free internet.

                        Then we only have Chromium to convince, and the rest follows implicitly.

                        daniel:// stenberg://undefined Questo utente è esterno a questo forum
                        daniel:// stenberg://undefined Questo utente è esterno a questo forum
                        daniel:// stenberg://
                        scritto su ultima modifica di
                        #13

                        @dascandy @suzannealdrich @jbqueru I'm sorry but already while I worked at Mozilla and Firefox my colleagues were in team WHATWG and I'm pretty sure they still are.

                        And doing a standard for URLs without having the super powers involved and interested is obviously not going to make a successful spec

                        1 Risposta Ultima Risposta
                        1
                        • daniel:// stenberg://undefined daniel:// stenberg://

                          @suzannealdrich @jbqueru and its impossible to be perfectly compliant because then suddenly the "spec" changes and you're not anymore. Not a way to build things like URLs that are supposed to in theory be possible to outlive us all.

                          Erin 💽✨undefined Questo utente è esterno a questo forum
                          Erin 💽✨undefined Questo utente è esterno a questo forum
                          Erin 💽✨
                          scritto su ultima modifica di
                          #14

                          @bagder @suzannealdrich @jbqueru also I note from your post that you find the WHATWG URL spec hard to read but I have to say that in general I find all WHATWG specifications nigh-unreadable

                          English but precisely defined pseudocode has to be one of the worst possible ways to write a specification

                          1 Risposta Ultima Risposta
                          1
                          • Oblomovundefined Oblomov ha condiviso questa discussione
                          Rispondi
                          • Topic risposta
                          Effettua l'accesso per rispondere
                          • Da Vecchi a Nuovi
                          • Da Nuovi a Vecchi
                          • Più Voti


                          • Accedi

                          • Accedi o registrati per effettuare la ricerca.
                          • Primo post
                            Ultimo post