Catch up to recent changes in whatwg/url

[domenic]

The URL Standard has recently made a few minor normative changes which Node.js should probably track:

• Remove U+0000 case in fragment state
• Verify domain is not empty after Unicode ToASCII

It's also possible other not-so-recent changes were missed, e.g. I didn't see anything labeled whatwg-url when I searched for "gopher" on the issue tracker that would correspond to whatwg/url@d589670 and whatwg/url@7ae1c69.

Finally I'll mention that whatwg/url#459 is likely to land soon (forbid < and > in hosts).

I've suggested to @annevk that he file bugs on Node.js for any such normative changes, but for now I wanted to file this one to help the project track.

[jasnell]

Thank you @domenic ... this is extremely helpful. I'm going to reframe your list into a todo checklist so we can use this as a tracking issue for these items.

• Remove U+0000 case in fragment state
• Verify domain is not empty after Unicode ToASCII
• gopher updates whatwg/url@d589670 and whatwg/url@7ae1c69 (being worked on right now, url: remove gopher from special schemes #33325)
• Forbid < and > in hosts (src: forbid lt and gt in url host code point #33328)

/cc @nodejs/url

[domenic]

Note that there might be more; I didn't confirm when was the last time Node's implementation synced with the spec.

[jasnell]

Yeah, we're overdo for an audit on that for sure. I'll try to schedule some time to do it but wouldn't object if another contributor got to it first ;-)

[targos]

I'm doing the gopher change.

PR: #33325

[yashLadha]

@jasnell I think Forbid < and > in hosts is already covered for not allowed hostname check:

node/lib/url.js

Lines 311 to 312 in 8607f9e

	case CHAR_LEFT_ANGLE_BRACKET:
	case CHAR_RIGHT_ANGLE_BRACKET:

However, the check for the same is missing in node_url.cc

[yashLadha]

Can I take the Verify domain is not empty after Unicode ToASCII? @jasnell

I think it is probably related to checking for the empty host value as sometimes the hostname can be invalid.

node/src/node_url.cc

Line 2277 in 8607f9e

args.GetReturnValue().Set(FIXED_ONE_BYTE_STRING(env->isolate(), ""));

A check can be placed at:

node/lib/internal/url.js

Line 1257 in 8607f9e

return _domainToASCII(`${domain}`);

on the return value

[annevk]

whatwg/url#505 is another one I'd like to make, though it still needs some implementer discussion. (I can start filing new issues from now on as well though, let me know.)

[Trott]

(I can start filing new issues from now on as well though, let me know.)

I would prefer a new issue for each thing rather than a perpetually open tracking issue, but @jasnell or others may feel differently. Either is way is better than not having the issue noted somewhere in the tracker, so although I have a mild preference, I'm happy either way. (And thanks!!!!)

[jasnell]

For additional issues, separate issues are better.

[watilde]

Closing as resolved by #33770. Thank you.