Salta al contenuto
0
  • Categorie
  • Recenti
  • Tag
  • Popolare
  • Mondo
  • Utenti
  • Gruppi
  • Categorie
  • Recenti
  • Tag
  • Popolare
  • Mondo
  • Utenti
  • Gruppi
Collassa

Forum Federato

Di Piero Bosio
  1. Home
  2. Categorie
  3. Senza categoria
  4. Having ongoing discussions about URL parsing differences as a basis for a #curl security vulnerability report made me check when I wrote my "my URL isn't your URL" blog post.

Having ongoing discussions about URL parsing differences as a basis for a #curl security vulnerability report made me check when I wrote my "my URL isn't your URL" blog post.

Pianificato Fissato Bloccato Spostato Senza categoria
curl
14 Post 5 Autori 2 Visualizzazioni
  • Da Vecchi a Nuovi
  • Da Nuovi a Vecchi
  • Più Voti
Rispondi
  • Topic risposta
Effettua l'accesso per rispondere
Questa discussione è stata eliminata. Solo gli utenti con diritti di gestione possono vederla.
  • daniel:// stenberg://undefined daniel:// stenberg://

    @jbqueru I've been told in discussions with WHATWG people that their specs (they call them specs) are both: documents how browsers work and they say how browsers should work. When I've pointed out discrepancies in the past (browsers that didn't follow their spec), the answer have usually been that it will be fixed in a future browser release and that the spec is right.

    Jean-Baptiste "JBQ" Quéruundefined Questo utente è esterno a questo forum
    Jean-Baptiste "JBQ" Quéruundefined Questo utente è esterno a questo forum
    Jean-Baptiste "JBQ" Quéru
    scritto su ultima modifica di
    #5

    @bagder That's been my experience as well.

    I personally disagree with the approach, because the so-called "spec" ends up ossifying the behavior of a prototype, instead of learning from it and creating a cleaner spec. WHATWG doesn't learn from mistakes or fix them, it propagates and perpetuates mistakes.

    Suzanne Aldrich (she/her)undefined 1 Risposta Ultima Risposta
    • Jean-Baptiste "JBQ" Quéruundefined Jean-Baptiste "JBQ" Quéru

      @bagder That's been my experience as well.

      I personally disagree with the approach, because the so-called "spec" ends up ossifying the behavior of a prototype, instead of learning from it and creating a cleaner spec. WHATWG doesn't learn from mistakes or fix them, it propagates and perpetuates mistakes.

      Suzanne Aldrich (she/her)undefined Questo utente è esterno a questo forum
      Suzanne Aldrich (she/her)undefined Questo utente è esterno a questo forum
      Suzanne Aldrich (she/her)
      scritto su ultima modifica di
      #6

      @jbqueru @bagder well then. that's not engineering. that's hoarding behavior.

      daniel:// stenberg://undefined 1 Risposta Ultima Risposta
      • Suzanne Aldrich (she/her)undefined Suzanne Aldrich (she/her)

        @jbqueru @bagder well then. that's not engineering. that's hoarding behavior.

        daniel:// stenberg://undefined Questo utente è esterno a questo forum
        daniel:// stenberg://undefined Questo utente è esterno a questo forum
        daniel:// stenberg://
        scritto su ultima modifica di
        #7

        @suzannealdrich @jbqueru and its impossible to be perfectly compliant because then suddenly the "spec" changes and you're not anymore. Not a way to build things like URLs that are supposed to in theory be possible to outlive us all.

        Peter Bindelsundefined Erin 💽✨undefined 2 Risposte Ultima Risposta
        • daniel:// stenberg://undefined daniel:// stenberg://

          @suzannealdrich @jbqueru and its impossible to be perfectly compliant because then suddenly the "spec" changes and you're not anymore. Not a way to build things like URLs that are supposed to in theory be possible to outlive us all.

          Peter Bindelsundefined Questo utente è esterno a questo forum
          Peter Bindelsundefined Questo utente è esterno a questo forum
          Peter Bindels
          scritto su ultima modifica di
          #8

          @bagder @suzannealdrich @jbqueru

          I know I'm coming at URL parsing from a clean brain, but can't we specify the base things in an actually parseable way? Surely it's not *that* hard to parse a URL?

          daniel:// stenberg://undefined 1 Risposta Ultima Risposta
          • Peter Bindelsundefined Peter Bindels

            @bagder @suzannealdrich @jbqueru

            I know I'm coming at URL parsing from a clean brain, but can't we specify the base things in an actually parseable way? Surely it's not *that* hard to parse a URL?

            daniel:// stenberg://undefined Questo utente è esterno a questo forum
            daniel:// stenberg://undefined Questo utente è esterno a questo forum
            daniel:// stenberg://
            scritto su ultima modifica di
            #9

            @dascandy @suzannealdrich @jbqueru we could theoretically do that, sure.

            Peter Bindelsundefined 1 Risposta Ultima Risposta
            • daniel:// stenberg://undefined daniel:// stenberg://

              @dascandy @suzannealdrich @jbqueru we could theoretically do that, sure.

              Peter Bindelsundefined Questo utente è esterno a questo forum
              Peter Bindelsundefined Questo utente è esterno a questo forum
              Peter Bindels
              scritto su ultima modifica di
              #10

              @bagder @suzannealdrich @jbqueru

              Taking a stab in the dark with some EBNF:

              url ::= protocol '://' [ name [ ':' name ] '@' ] [ server ] [ '/' [ path ] [ '?' arg { '&' arg } ] ]
              protocol ::= name
              server ::= name { '.' name }
              path ::= name { '/' name }
              arg ::= name [ '=' name ]

              name = ([^:/@?&=.%]|%[0-9a-f][0-9a-f])+

              I understand that whatwg makes that :// not a required part ... but this kinda matches what my naive brain thinks of as a URL and how to read it.

              daniel:// stenberg://undefined 1 Risposta Ultima Risposta
              • Peter Bindelsundefined Peter Bindels

                @bagder @suzannealdrich @jbqueru

                Taking a stab in the dark with some EBNF:

                url ::= protocol '://' [ name [ ':' name ] '@' ] [ server ] [ '/' [ path ] [ '?' arg { '&' arg } ] ]
                protocol ::= name
                server ::= name { '.' name }
                path ::= name { '/' name }
                arg ::= name [ '=' name ]

                name = ([^:/@?&=.%]|%[0-9a-f][0-9a-f])+

                I understand that whatwg makes that :// not a required part ... but this kinda matches what my naive brain thinks of as a URL and how to read it.

                daniel:// stenberg://undefined Questo utente è esterno a questo forum
                daniel:// stenberg://undefined Questo utente è esterno a questo forum
                daniel:// stenberg://
                scritto su ultima modifica di
                #11

                @dascandy @suzannealdrich @jbqueru add port numbers, IP addresses (v4, v6, zone id?), add options? How about IDN?

                I see you used two slashes, but URIs actually don't have that. Many have no slashes at all.

                But sure, everything *could* be written down in a spec. Getting the world to agree with that spec though: not so easy.

                Peter Bindelsundefined 1 Risposta Ultima Risposta
                • daniel:// stenberg://undefined daniel:// stenberg://

                  @dascandy @suzannealdrich @jbqueru add port numbers, IP addresses (v4, v6, zone id?), add options? How about IDN?

                  I see you used two slashes, but URIs actually don't have that. Many have no slashes at all.

                  But sure, everything *could* be written down in a spec. Getting the world to agree with that spec though: not so easy.

                  Peter Bindelsundefined Questo utente è esterno a questo forum
                  Peter Bindelsundefined Questo utente è esterno a questo forum
                  Peter Bindels
                  scritto su ultima modifica di
                  #12

                  @bagder @suzannealdrich @jbqueru

                  If Curl and Firefox start by advocating "this is the spec for URIs, and other things might work or might not" that would already be a good start for the free internet.

                  Then we only have Chromium to convince, and the rest follows implicitly.

                  daniel:// stenberg://undefined 1 Risposta Ultima Risposta
                  • Peter Bindelsundefined Peter Bindels

                    @bagder @suzannealdrich @jbqueru

                    If Curl and Firefox start by advocating "this is the spec for URIs, and other things might work or might not" that would already be a good start for the free internet.

                    Then we only have Chromium to convince, and the rest follows implicitly.

                    daniel:// stenberg://undefined Questo utente è esterno a questo forum
                    daniel:// stenberg://undefined Questo utente è esterno a questo forum
                    daniel:// stenberg://
                    scritto su ultima modifica di
                    #13

                    @dascandy @suzannealdrich @jbqueru I'm sorry but already while I worked at Mozilla and Firefox my colleagues were in team WHATWG and I'm pretty sure they still are.

                    And doing a standard for URLs without having the super powers involved and interested is obviously not going to make a successful spec

                    1 Risposta Ultima Risposta
                    1
                    • daniel:// stenberg://undefined daniel:// stenberg://

                      @suzannealdrich @jbqueru and its impossible to be perfectly compliant because then suddenly the "spec" changes and you're not anymore. Not a way to build things like URLs that are supposed to in theory be possible to outlive us all.

                      Erin 💽✨undefined Questo utente è esterno a questo forum
                      Erin 💽✨undefined Questo utente è esterno a questo forum
                      Erin 💽✨
                      scritto su ultima modifica di
                      #14

                      @bagder @suzannealdrich @jbqueru also I note from your post that you find the WHATWG URL spec hard to read but I have to say that in general I find all WHATWG specifications nigh-unreadable

                      English but precisely defined pseudocode has to be one of the worst possible ways to write a specification

                      1 Risposta Ultima Risposta
                      1
                      • Oblomovundefined Oblomov ha condiviso questa discussione
                      Rispondi
                      • Topic risposta
                      Effettua l'accesso per rispondere
                      • Da Vecchi a Nuovi
                      • Da Nuovi a Vecchi
                      • Più Voti


                      • Accedi

                      • Accedi o registrati per effettuare la ricerca.
                      • Primo post
                        Ultimo post