Re: [apps-discuss] Fun with URLs and regex

[Mark Nottingham <[e-mail]>]

> On 28 Jan 2015, at 1:24 pm, Sam Ruby <[e-mail]> wrote:
> 
> On 1/27/15 8:53 PM, Mark Nottingham wrote:
>> Hi Sam,
>> 
>>> On 9 Jan 2015, at 3:54 am, Sam Ruby <[e-mail]> wrote:
>>> 
>>> Mark cares about valid URIs.  He's certainly not alone in that.  What he has done is express his interests not merely in high level prose, but in concrete, executable form.  Given that he has done that, I can pose some interesting questions.  For example, if you consider the process of canonicalizing a href value on an <a> element and stringifying the result, an implementation like Chrome will produce something that will be sent across the wire.  I've captured the results here:
>>> 
>>> https://raw.githubusercontent.com/webspecs/url/develop/evaluate/useragent-results/chrome
>>> 
>>> Given that data and Mark's script, I can produce a list of outputs that Mark doesn't consider valid:
>> 
>> [...]
>> 
>>> With this data, we can have a discussion as to whether Mark's script should be updated, or Chrome should change, or some spec should change.
>> 
>> What I was hoping for was an update of the "valid URI" filter to take this into account at <https://url.spec.whatwg.org/interop/test-results/?filter=valid>.
>> 
>> E.g., that list currently includes test case 63, "https:/example.com/", which is valid according to the generic syntax in RFC3986, but not when you consider the scheme-specific constraints for HTTPS in RFC7230.
>> 
>> By filtering out these cases, we can see the places we potentially need to pay attention to in the RFCs.
>> 
>> Is that possible?
> 
> Since that code runs filters on the browser, it would be easiest for me integrate code written in JavaScript.
> 
> Can you review the generated JavaScript?
> 
> https://url.spec.whatwg.org/reference-implementation/uri-validate.js
> https://url.spec.whatwg.org/reference-implementation/uri-validate.html

It looks like a reasonable transcription. I do notice you copied my error:

return new RegExp("^" + known[scheme] + "(#|$)").test(string)

I think it should just be:

return new RegExp("^" + known[scheme] + "$").test(string)

... which brings about another interesting observation -- only http and https define fragments in their syntax; the other schemes do not.


> Also, I would like to discuss where this code should live:
> 
> http://www.ietf.org/mail-archive/web/apps-discuss/current/msg13635.html

I want to keep it going in Python, so I'll probably create a separate repo at some point; is it bothersome to just keep the JS in your repo?

If bugs are found in the regex themselves, I'll make sure to notify you (and would appreciate the same).

Cheers,



--
Mark Nottingham   https://www.mnot.net/