Parsing misclassification if the password begins with ? or / or #

[2xyo]

trafficstars

These URLs cause a misclassification:

• http://test:[email protected]
  • test: -> URL network location
  • [email protected] -> URL query
• http://test:/[email protected]
  • test: -> URL network location
  • /[email protected] -> URL path
• http://test:#[email protected]
  • test: -> URL network location
  • [email protected] -> URL fragment

The misclassification appears if the password begins with a delimiter defined in RFC3986, section 3.2:

The authority component is preceded by a double slash ("//") and is
terminated by the next slash ("/"), question mark ("?"), or number
sign ("#") character, or by the end of the URI.

[obsidianforensics]

Unfurl uses urllib.parse for this functionality, and it appears this bug is known / being fixed (https://bugs.python.org/issue37854), although the time frame is unclear to me.

I think we'll wait for the urllib.parse bug to get fixed over re-implementing ourselves. Thank you for the bug report though!

[obsidianforensics]

Checked urllib's bug again, still no progress.

[obsidianforensics]

Checked urllib's bug again, still no progress.