Re: [apps-discuss] Fun with URLs and regex

[Sam Ruby <[e-mail]>]

On 01/28/2015 12:36 AM, Mark Nottingham wrote:
>
>> On 28 Jan 2015, at 1:24 pm, Sam Ruby <[e-mail]> wrote:
>>
>> On 1/27/15 8:53 PM, Mark Nottingham wrote:
>>> Hi Sam,
>>>
>>>> On 9 Jan 2015, at 3:54 am, Sam Ruby <[e-mail]> wrote:
>>>>
>>>> Mark cares about valid URIs.  He's certainly not alone in that.  What he has done is express his interests not merely in high level prose, but in concrete, executable form.  Given that he has done that, I can pose some interesting questions.  For example, if you consider the process of canonicalizing a href value on an <a> element and stringifying the result, an implementation like Chrome will produce something that will be sent across the wire.  I've captured the results here:
>>>>
>>>> https://raw.githubusercontent.com/webspecs/url/develop/evaluate/useragent-results/chrome
>>>>
>>>> Given that data and Mark's script, I can produce a list of outputs that Mark doesn't consider valid:
>>>
>>> [...]
>>>
>>>> With this data, we can have a discussion as to whether Mark's script should be updated, or Chrome should change, or some spec should change.
>>>
>>> What I was hoping for was an update of the "valid URI" filter to take this into account at <https://url.spec.whatwg.org/interop/test-results/?filter=valid>.
>>>
>>> E.g., that list currently includes test case 63, "https:/example.com/", which is valid according to the generic syntax in RFC3986, but not when you consider the scheme-specific constraints for HTTPS in RFC7230.
>>>
>>> By filtering out these cases, we can see the places we potentially need to pay attention to in the RFCs.
>>>
>>> Is that possible?
>>
>> Since that code runs filters on the browser, it would be easiest for me integrate code written in JavaScript.
>>
>> Can you review the generated JavaScript?
>>
>> https://url.spec.whatwg.org/reference-implementation/uri-validate.js
>> https://url.spec.whatwg.org/reference-implementation/uri-validate.html
>
> It looks like a reasonable transcription. I do notice you copied my error:
>
> return new RegExp("^" + known[scheme] + "(#|$)").test(string)

Not a copy: it's actually different.  My version checks for a match on 
the regular expression followed by either a hash mark or the end of the 
string.

> I think it should just be:
>
> return new RegExp("^" + known[scheme] + "$").test(string)
>
> ... which brings about another interesting observation -- only http and https define fragments in their syntax; the other schemes do not.

I can make that change.

>> Also, I would like to discuss where this code should live:
>>
>> http://www.ietf.org/mail-archive/web/apps-discuss/current/msg13635.html
>
> I want to keep it going in Python, so I'll probably create a separate repo at some point; is it bothersome to just keep the JS in your repo?

I'm not proposing changing it from Python.

What I have is a script that does the conversion:

https://gist.github.com/rubys/b9ccaf304f06cf3e2e88

> If bugs are found in the regex themselves, I'll make sure to notify you (and would appreciate the same).

I'd suggest putting them both in the same repository.

In any case, later today I'll update my filter to replace the validation 
check with yours.

> Cheers,
>
> --
> Mark Nottingham   https://www.mnot.net/

- Sam Ruby