Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:127274
Precedence: bulk
MIME-Version: 1.0
References: <CAH5C8xUb1O20ZDrOQNC=ckFxHUUWSK7sw_njQQzFBd0qgQqoww@mail.gmail.com>
 <bc5472e39bc607e2c7accc9d2bd6f239@bastelstu.be> <CAH5C8xW_auVf+ig7odhTK8dVWwmXTg4ZVZN-0Fhh4SUBzrWxVw@mail.gmail.com>
 <8df04e01-deac-404b-beb7-cd982423db63@bastelstu.be> <CAH5C8xU0JcnmC2Hdd=Hj0CQUaL0-LN=1X8+5-eUbFH3ZMxCvBA@mail.gmail.com>
 <33427cd03035ef084245c44290b56a55@bastelstu.be> <CAH5C8xXwDO6Ui8pLmqoxEguURh97fAaL4CfLK-oitqC85N7+8w@mail.gmail.com>
 <0aa1eefc3941bdea0092e935074daa58@bastelstu.be> <CAH5C8xU+rnp4e5=CzqhEncRww6nhZ7x1s68NjWtu+HQMpoNZ8g@mail.gmail.com>
 <76d96ea8a78c6025128c0a4b01c94c0a@bastelstu.be> <CAH5C8xXLPoRLJ6_dtotMtOv2NWs4LFzu+Kpr5A56Xk8wmuPDEg@mail.gmail.com>
 <07a8a580-4f0c-4b2f-8a67-b91dacfe99bf@bastelstu.be> <CAOV5rgZZgSjGWFdhWm7qwiRxeRMvf7ScgoPZZEXgnvK8Qyw38w@mail.gmail.com>
 <CAH5C8xWSaSXDoXJ-18WptA-dN6Tt6N-DUwLk6PxR1ERP_pwSLA@mail.gmail.com>
 <CAOV5rgYx-EeAN=TFa02pCG-7=KJTmLEf=WtXDTBUmUwnJPRcow@mail.gmail.com>
 <CAOV5rgbcCd1pp05xmtEu9SgCjDqu1FXfJPwPfczqH1L_q=pS7w@mail.gmail.com>
 <809590c3-fd64-4861-8804-1c9eea62a4a8@bastelstu.be> <CAOV5rgZh205T8Z4ZTN__xES-D6BBANT=yfws3L0Cu=y=nQOU4Q@mail.gmail.com>
In-Reply-To: <CAOV5rgZh205T8Z4ZTN__xES-D6BBANT=yfws3L0Cu=y=nQOU4Q@mail.gmail.com>
Date: Sat, 3 May 2025 23:05:56 +0200
Message-ID: <CAH5C8xU3A-fnEp-hiNX=_-hK5Obma+u==+G3g+XvK0kUB-U7CQ@mail.gmail.com>
Subject: Re: [PHP-DEV] [RFC] [Discussion] Add WHATWG compliant URL parsing API
To: ignace nyamagana butera <nyamsprod@gmail.com>
Cc: =?UTF-8?Q?Tim_D=C3=BCsterhus?= <tim@bastelstu.be>, 
	PHP Internals List <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000b3fa0b063441a2cf"
From: kocsismate90@gmail.com (=?UTF-8?B?TcOhdMOpIEtvY3Npcw==?=)

--000000000000b3fa0b063441a2cf
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Ignace,

I have just added the SensitiveParameter attribute to the
Uri\Rfc3986\Uri::withUserInfo() and Uri\WhatWg\Url::withPassword() methods.


> Reading the WHATWG URL specification and checking how
>
>    - Chrome,
>    - Firefox
>    - and even https://github.com/TRowbotham/URL-Parser
>
>
> behave I see that mutator either silently reject the invalid input on
> setter or normalize them I was wondering if it still make sense to still
> say that URL mutator can throws InvalldUrlException ? Since AFAIK only a
> TypeError could actually be thrown if the wrong input is given, no
> specially crafted string can make the spec throw unless I have overlooked
> it.
>

I double the checked the implementation, and I quickly managed to find a
case when an exception is thrown:

$url =3D new Uri\WhatWg\Url("https://example.com");
$url->withHost("[1.2.3.4");

The above code will throw a Uri\WhatWg\InvalidUrlException that refers to
the "IPv6-unclosed" WHATWG URL error,
so I think it makes sense to keep the current behavior, especially with
respect to possible future changes of the specification.

Regards,
M=C3=A1t=C3=A9

--000000000000b3fa0b063441a2cf
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">Hi Ignace,<div><br></div><div>I have just=
 added the SensitiveParameter attribute to the Uri\Rfc3986\Uri::withUserInf=
o() and Uri\WhatWg\Url::withPassword() methods.</div><div><br></div></div><=
div class=3D"gmail_quote gmail_quote_container"><blockquote class=3D"gmail_=
quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,=
204);padding-left:1ex"><div dir=3D"ltr"><div><span style=3D"color:rgb(51,51=
,51);font-family:&quot;Fira Sans&quot;,&quot;Source Sans Pro&quot;,Helvetic=
a,Arial,sans-serif;font-size:16px"><br></span></div><div><span style=3D"col=
or:rgb(51,51,51)"><font face=3D"arial, sans-serif">Reading the WHATWG=C2=A0=
URL specification and checking how=C2=A0</font></span></div><div><ul><li><s=
pan style=3D"color:rgb(51,51,51)"><font face=3D"arial, sans-serif">Chrome,=
=C2=A0</font></span></li><li><span style=3D"color:rgb(51,51,51)"><font face=
=3D"arial, sans-serif">Firefox=C2=A0</font></span></li><li><font face=3D"ar=
ial, sans-serif"><font color=3D"#333333">and even <a href=3D"https://github=
.com/TRowbotham/URL-Parser" target=3D"_blank">https://github.com/TRowbotham=
/URL-Parser</a><br></font></font><br></li></ul>behave I see that mutator ei=
ther silently reject the invalid input on setter or normalize them I was wo=
ndering if it still make sense to still say that URL=C2=A0mutator can throw=
s=C2=A0InvalldUrlException<span style=3D"font-family:arial,sans-serif;color=
:rgb(51,51,51)">=C2=A0? Since AFAIK only a TypeError could actually be thro=
wn if the wrong input is given, no specially crafted string can make the sp=
ec throw unless I have overlooked it.</span></div></div></blockquote><div><=
br></div><div>I double the checked the implementation, and I quickly manage=
d to find a case when an exception is thrown:</div><div><br></div><div>$url=
 =3D new Uri\WhatWg\Url(&quot;<a href=3D"https://example.com">https://examp=
le.com</a>&quot;);<br>$url-&gt;withHost(&quot;[1.2.3.4&quot;);</div><div><b=
r></div><div>The above code will throw a=C2=A0Uri\WhatWg\InvalidUrlExceptio=
n that refers to the &quot;IPv6-unclosed&quot; WHATWG URL error,</div><div>=
so I think it makes sense to keep the current behavior, especially with res=
pect to possible future changes of the specification.</div><div><br></div><=
div>Regards,</div><div>M=C3=A1t=C3=A9</div><div>=C2=A0</div></div></div>

--000000000000b3fa0b063441a2cf--