http The hyperium URI parser is stricter than the url crate

Over in Servo, we've seen cases where URLs that the urlcrate parsed were then rejected by hyper: https://github.com/servo/servo/issues/24175. The case we hit https://github.com/servo/servo/pull/24148#issuecomment-529963631 was the URL http://"empty_script.js/?id=5\\%22, but there are probably other instances.

Sep 10 '19 17:09 asajeffrey

http::Uri actually parses HTTP request targets. If I'm reading the RFC correctly, the character " is not a valid character in the authority part of an absolute-form HTTP request target.

Are you sure that it is valid? I tried to check how Firefox would serialize this URL to the HTTP request, but it seems Firefox doesn't consider it to be a valid URL either so couldn't get it to work.

Sep 17 '19 07:09 bluetech

@SimonSapin?

Sep 17 '19 12:09 asajeffrey

Should we really have a full URL given to Hyper as a single string to parse? I would expect Hyper to accept separately a protocol (as an enum or as separate APIs), a impl std::net::ToSocketAddrs for the purpose of opening a TCP or UDP, socket, and a request-target that goes in the HTTP request. The latter’s most (?) typical form is a path with optional query string.

Sep 17 '19 14:09 SimonSapin

@SimonSapin the particular case that was problematic here was a referer header, not opening a connection.

Sep 17 '19 15:09 asajeffrey