Re: [apps-discuss] Fun with URLs and regex

Mark Nottingham <> Wed, 28 January 2015 05:36 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 634841A0018 for <>; Tue, 27 Jan 2015 21:36:33 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.602
X-Spam-Status: No, score=-2.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id cDSTsZNEvJI3 for <>; Tue, 27 Jan 2015 21:36:31 -0800 (PST)
Received: from ( []) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 50A281A0016 for <>; Tue, 27 Jan 2015 21:36:31 -0800 (PST)
Received: from [] (unknown []) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPSA id 2955E22E264; Wed, 28 Jan 2015 00:36:24 -0500 (EST)
Content-Type: text/plain; charset="windows-1252"
Mime-Version: 1.0 (Mac OS X Mail 8.1 \(1993\))
From: Mark Nottingham <>
In-Reply-To: <>
Date: Wed, 28 Jan 2015 16:36:20 +1100
Content-Transfer-Encoding: quoted-printable
Message-Id: <>
References: <> <> <> <> <> <>
To: Sam Ruby <>
X-Mailer: Apple Mail (2.1993)
Archived-At: <>
Cc: IETF Apps Discuss <>
Subject: Re: [apps-discuss] Fun with URLs and regex
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: General discussion of application-layer protocols <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 28 Jan 2015 05:36:33 -0000

> On 28 Jan 2015, at 1:24 pm, Sam Ruby <> wrote:
> On 1/27/15 8:53 PM, Mark Nottingham wrote:
>> Hi Sam,
>>> On 9 Jan 2015, at 3:54 am, Sam Ruby <> wrote:
>>> Mark cares about valid URIs.  He's certainly not alone in that.  What he has done is express his interests not merely in high level prose, but in concrete, executable form.  Given that he has done that, I can pose some interesting questions.  For example, if you consider the process of canonicalizing a href value on an <a> element and stringifying the result, an implementation like Chrome will produce something that will be sent across the wire.  I've captured the results here:
>>> Given that data and Mark's script, I can produce a list of outputs that Mark doesn't consider valid:
>> [...]
>>> With this data, we can have a discussion as to whether Mark's script should be updated, or Chrome should change, or some spec should change.
>> What I was hoping for was an update of the "valid URI" filter to take this into account at <>.
>> E.g., that list currently includes test case 63, "https:/", which is valid according to the generic syntax in RFC3986, but not when you consider the scheme-specific constraints for HTTPS in RFC7230.
>> By filtering out these cases, we can see the places we potentially need to pay attention to in the RFCs.
>> Is that possible?
> Since that code runs filters on the browser, it would be easiest for me integrate code written in JavaScript.
> Can you review the generated JavaScript?

It looks like a reasonable transcription. I do notice you copied my error:

return new RegExp("^" + known[scheme] + "(#|$)").test(string)

I think it should just be:

return new RegExp("^" + known[scheme] + "$").test(string)

... which brings about another interesting observation -- only http and https define fragments in their syntax; the other schemes do not.

> Also, I would like to discuss where this code should live:

I want to keep it going in Python, so I'll probably create a separate repo at some point; is it bothersome to just keep the JS in your repo?

If bugs are found in the regex themselves, I'll make sure to notify you (and would appreciate the same).


Mark Nottingham