Uku Sõrmus

Wrong usage of JS functions (Appendix: Leveraging Dev Tools - Encoding and Decoding)

1

**What's the issue?** In [Appendix: Leveraging Dev Tools > Encoding and Decoding](https://owasp.org/www-project-web-security-testing-guide/stable/6-Appendix/F-Leveraging_Dev_Tools#encoding-and-decoding): - Suggesting use of `escape()` and `unescape()` JavaScript functions for HTML encoding/decoding, while: - these functions do not...

"host" component missing from Live URL Viewer

1

Is there any particular reason that `host` is missing from the listed components in [Live URL Viewer](https://jsdom.github.io/whatwg-url/)? I can see the `host()` getter present under `lib/URL-impl.js`. It exists under the...

Empty labels (consecutive dots, and trailing dot for host writing + UTS46)

1

### What is the issue with the URL Standard? 1. Is there any reason to continue allowing consecutive dots in a domain, at all? ```js new URL("https://a...b..c...d./").hostname // "a...b..c...d." ```...

### What is the issue with the URL Standard? URL API "host" getter can return a port, but the definition for "host" itself doesn't include port. This may cause confusion...

### What is the issue with the URL Standard? The usage of the term "hostname" could be clarified in the spec, because the popular usage of the term ("domain name")...

Trailing dot should be concatenated, according to PSL algorithm & WHATWG URL standard

1

PSL algorithm, : > Note 3 > [...] looking up `example.com` should yield `com` while looking up `example.com.` should yield `com.` as the public suffix. WHATWG URL standard, : >...

### What is the issue with the Fetch Standard? ### Background [Atomic HTTP redirect handling](https://fetch.spec.whatwg.org/commit-snapshots/697b5060a2a54b2d071a1a9b32105f24037eccc8/#atomic-http-redirect-handling) states: > Redirects \[...\] are not exposed to APIs. Exposing redirects might leak information not...