Source file src/net/url/url.go

     1  // Copyright 2009 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  // Package url parses URLs and implements query escaping.
     6  //
     7  // See RFC 3986. This package generally follows RFC 3986, except where
     8  // it deviates for compatibility reasons.
     9  // RFC 6874 followed for IPv6 zone literals.
    10  package url
    11  
    12  // When sending changes, first  search old issues for history on decisions.
    13  // Unit tests should also contain references to issue numbers with details.
    14  
    15  import (
    16  	"errors"
    17  	"fmt"
    18  	"internal/godebug"
    19  	"maps"
    20  	"net/netip"
    21  	"path"
    22  	"slices"
    23  	"strconv"
    24  	"strings"
    25  	_ "unsafe" // for linkname
    26  )
    27  
    28  // Error reports an error and the operation and URL that caused it.
    29  type Error struct {
    30  	Op  string
    31  	URL string
    32  	Err error
    33  }
    34  
    35  func (e *Error) Unwrap() error { return e.Err }
    36  func (e *Error) Error() string { return fmt.Sprintf("%s %q: %s", e.Op, e.URL, e.Err) }
    37  
    38  func (e *Error) Timeout() bool {
    39  	t, ok := e.Err.(interface {
    40  		Timeout() bool
    41  	})
    42  	return ok && t.Timeout()
    43  }
    44  
    45  func (e *Error) Temporary() bool {
    46  	t, ok := e.Err.(interface {
    47  		Temporary() bool
    48  	})
    49  	return ok && t.Temporary()
    50  }
    51  
    52  const upperhex = "0123456789ABCDEF"
    53  
    54  func ishex(c byte) bool {
    55  	switch {
    56  	case '0' <= c && c <= '9':
    57  		return true
    58  	case 'a' <= c && c <= 'f':
    59  		return true
    60  	case 'A' <= c && c <= 'F':
    61  		return true
    62  	}
    63  	return false
    64  }
    65  
    66  func unhex(c byte) byte {
    67  	switch {
    68  	case '0' <= c && c <= '9':
    69  		return c - '0'
    70  	case 'a' <= c && c <= 'f':
    71  		return c - 'a' + 10
    72  	case 'A' <= c && c <= 'F':
    73  		return c - 'A' + 10
    74  	default:
    75  		panic("invalid hex character")
    76  	}
    77  }
    78  
    79  type encoding int
    80  
    81  const (
    82  	encodePath encoding = 1 + iota
    83  	encodePathSegment
    84  	encodeHost
    85  	encodeZone
    86  	encodeUserPassword
    87  	encodeQueryComponent
    88  	encodeFragment
    89  )
    90  
    91  type EscapeError string
    92  
    93  func (e EscapeError) Error() string {
    94  	return "invalid URL escape " + strconv.Quote(string(e))
    95  }
    96  
    97  type InvalidHostError string
    98  
    99  func (e InvalidHostError) Error() string {
   100  	return "invalid character " + strconv.Quote(string(e)) + " in host name"
   101  }
   102  
   103  // Return true if the specified character should be escaped when
   104  // appearing in a URL string, according to RFC 3986.
   105  //
   106  // Please be informed that for now shouldEscape does not check all
   107  // reserved characters correctly. See golang.org/issue/5684.
   108  func shouldEscape(c byte, mode encoding) bool {
   109  	// §2.3 Unreserved characters (alphanum)
   110  	if 'a' <= c && c <= 'z' || 'A' <= c && c <= 'Z' || '0' <= c && c <= '9' {
   111  		return false
   112  	}
   113  
   114  	if mode == encodeHost || mode == encodeZone {
   115  		// §3.2.2 Host allows
   116  		//	sub-delims = "!" / "$" / "&" / "'" / "(" / ")" / "*" / "+" / "," / ";" / "="
   117  		// as part of reg-name.
   118  		// We add : because we include :port as part of host.
   119  		// We add [ ] because we include [ipv6]:port as part of host.
   120  		// We add < > because they're the only characters left that
   121  		// we could possibly allow, and Parse will reject them if we
   122  		// escape them (because hosts can't use %-encoding for
   123  		// ASCII bytes).
   124  		switch c {
   125  		case '!', '$', '&', '\'', '(', ')', '*', '+', ',', ';', '=', ':', '[', ']', '<', '>', '"':
   126  			return false
   127  		}
   128  	}
   129  
   130  	switch c {
   131  	case '-', '_', '.', '~': // §2.3 Unreserved characters (mark)
   132  		return false
   133  
   134  	case '$', '&', '+', ',', '/', ':', ';', '=', '?', '@': // §2.2 Reserved characters (reserved)
   135  		// Different sections of the URL allow a few of
   136  		// the reserved characters to appear unescaped.
   137  		switch mode {
   138  		case encodePath: // §3.3
   139  			// The RFC allows : @ & = + $ but saves / ; , for assigning
   140  			// meaning to individual path segments. This package
   141  			// only manipulates the path as a whole, so we allow those
   142  			// last three as well. That leaves only ? to escape.
   143  			return c == '?'
   144  
   145  		case encodePathSegment: // §3.3
   146  			// The RFC allows : @ & = + $ but saves / ; , for assigning
   147  			// meaning to individual path segments.
   148  			return c == '/' || c == ';' || c == ',' || c == '?'
   149  
   150  		case encodeUserPassword: // §3.2.1
   151  			// The RFC allows ';', ':', '&', '=', '+', '$', and ',' in
   152  			// userinfo, so we must escape only '@', '/', and '?'.
   153  			// The parsing of userinfo treats ':' as special so we must escape
   154  			// that too.
   155  			return c == '@' || c == '/' || c == '?' || c == ':'
   156  
   157  		case encodeQueryComponent: // §3.4
   158  			// The RFC reserves (so we must escape) everything.
   159  			return true
   160  
   161  		case encodeFragment: // §4.1
   162  			// The RFC text is silent but the grammar allows
   163  			// everything, so escape nothing.
   164  			return false
   165  		}
   166  	}
   167  
   168  	if mode == encodeFragment {
   169  		// RFC 3986 §2.2 allows not escaping sub-delims. A subset of sub-delims are
   170  		// included in reserved from RFC 2396 §2.2. The remaining sub-delims do not
   171  		// need to be escaped. To minimize potential breakage, we apply two restrictions:
   172  		// (1) we always escape sub-delims outside of the fragment, and (2) we always
   173  		// escape single quote to avoid breaking callers that had previously assumed that
   174  		// single quotes would be escaped. See issue #19917.
   175  		switch c {
   176  		case '!', '(', ')', '*':
   177  			return false
   178  		}
   179  	}
   180  
   181  	// Everything else must be escaped.
   182  	return true
   183  }
   184  
   185  // QueryUnescape does the inverse transformation of [QueryEscape],
   186  // converting each 3-byte encoded substring of the form "%AB" into the
   187  // hex-decoded byte 0xAB.
   188  // It returns an error if any % is not followed by two hexadecimal
   189  // digits.
   190  func QueryUnescape(s string) (string, error) {
   191  	return unescape(s, encodeQueryComponent)
   192  }
   193  
   194  // PathUnescape does the inverse transformation of [PathEscape],
   195  // converting each 3-byte encoded substring of the form "%AB" into the
   196  // hex-decoded byte 0xAB. It returns an error if any % is not followed
   197  // by two hexadecimal digits.
   198  //
   199  // PathUnescape is identical to [QueryUnescape] except that it does not
   200  // unescape '+' to ' ' (space).
   201  func PathUnescape(s string) (string, error) {
   202  	return unescape(s, encodePathSegment)
   203  }
   204  
   205  // unescape unescapes a string; the mode specifies
   206  // which section of the URL string is being unescaped.
   207  func unescape(s string, mode encoding) (string, error) {
   208  	// Count %, check that they're well-formed.
   209  	n := 0
   210  	hasPlus := false
   211  	for i := 0; i < len(s); {
   212  		switch s[i] {
   213  		case '%':
   214  			n++
   215  			if i+2 >= len(s) || !ishex(s[i+1]) || !ishex(s[i+2]) {
   216  				s = s[i:]
   217  				if len(s) > 3 {
   218  					s = s[:3]
   219  				}
   220  				return "", EscapeError(s)
   221  			}
   222  			// Per https://tools.ietf.org/html/rfc3986#page-21
   223  			// in the host component %-encoding can only be used
   224  			// for non-ASCII bytes.
   225  			// But https://tools.ietf.org/html/rfc6874#section-2
   226  			// introduces %25 being allowed to escape a percent sign
   227  			// in IPv6 scoped-address literals. Yay.
   228  			if mode == encodeHost && unhex(s[i+1]) < 8 && s[i:i+3] != "%25" {
   229  				return "", EscapeError(s[i : i+3])
   230  			}
   231  			if mode == encodeZone {
   232  				// RFC 6874 says basically "anything goes" for zone identifiers
   233  				// and that even non-ASCII can be redundantly escaped,
   234  				// but it seems prudent to restrict %-escaped bytes here to those
   235  				// that are valid host name bytes in their unescaped form.
   236  				// That is, you can use escaping in the zone identifier but not
   237  				// to introduce bytes you couldn't just write directly.
   238  				// But Windows puts spaces here! Yay.
   239  				v := unhex(s[i+1])<<4 | unhex(s[i+2])
   240  				if s[i:i+3] != "%25" && v != ' ' && shouldEscape(v, encodeHost) {
   241  					return "", EscapeError(s[i : i+3])
   242  				}
   243  			}
   244  			i += 3
   245  		case '+':
   246  			hasPlus = mode == encodeQueryComponent
   247  			i++
   248  		default:
   249  			if (mode == encodeHost || mode == encodeZone) && s[i] < 0x80 && shouldEscape(s[i], mode) {
   250  				return "", InvalidHostError(s[i : i+1])
   251  			}
   252  			i++
   253  		}
   254  	}
   255  
   256  	if n == 0 && !hasPlus {
   257  		return s, nil
   258  	}
   259  
   260  	var t strings.Builder
   261  	t.Grow(len(s) - 2*n)
   262  	for i := 0; i < len(s); i++ {
   263  		switch s[i] {
   264  		case '%':
   265  			t.WriteByte(unhex(s[i+1])<<4 | unhex(s[i+2]))
   266  			i += 2
   267  		case '+':
   268  			if mode == encodeQueryComponent {
   269  				t.WriteByte(' ')
   270  			} else {
   271  				t.WriteByte('+')
   272  			}
   273  		default:
   274  			t.WriteByte(s[i])
   275  		}
   276  	}
   277  	return t.String(), nil
   278  }
   279  
   280  // QueryEscape escapes the string so it can be safely placed
   281  // inside a [URL] query.
   282  func QueryEscape(s string) string {
   283  	return escape(s, encodeQueryComponent)
   284  }
   285  
   286  // PathEscape escapes the string so it can be safely placed inside a [URL] path segment,
   287  // replacing special characters (including /) with %XX sequences as needed.
   288  func PathEscape(s string) string {
   289  	return escape(s, encodePathSegment)
   290  }
   291  
   292  func escape(s string, mode encoding) string {
   293  	spaceCount, hexCount := 0, 0
   294  	for i := 0; i < len(s); i++ {
   295  		c := s[i]
   296  		if shouldEscape(c, mode) {
   297  			if c == ' ' && mode == encodeQueryComponent {
   298  				spaceCount++
   299  			} else {
   300  				hexCount++
   301  			}
   302  		}
   303  	}
   304  
   305  	if spaceCount == 0 && hexCount == 0 {
   306  		return s
   307  	}
   308  
   309  	var buf [64]byte
   310  	var t []byte
   311  
   312  	required := len(s) + 2*hexCount
   313  	if required <= len(buf) {
   314  		t = buf[:required]
   315  	} else {
   316  		t = make([]byte, required)
   317  	}
   318  
   319  	if hexCount == 0 {
   320  		copy(t, s)
   321  		for i := 0; i < len(s); i++ {
   322  			if s[i] == ' ' {
   323  				t[i] = '+'
   324  			}
   325  		}
   326  		return string(t)
   327  	}
   328  
   329  	j := 0
   330  	for i := 0; i < len(s); i++ {
   331  		switch c := s[i]; {
   332  		case c == ' ' && mode == encodeQueryComponent:
   333  			t[j] = '+'
   334  			j++
   335  		case shouldEscape(c, mode):
   336  			t[j] = '%'
   337  			t[j+1] = upperhex[c>>4]
   338  			t[j+2] = upperhex[c&15]
   339  			j += 3
   340  		default:
   341  			t[j] = s[i]
   342  			j++
   343  		}
   344  	}
   345  	return string(t)
   346  }
   347  
   348  // A URL represents a parsed URL (technically, a URI reference).
   349  //
   350  // The general form represented is:
   351  //
   352  //	[scheme:][//[userinfo@]host][/]path[?query][#fragment]
   353  //
   354  // URLs that do not start with a slash after the scheme are interpreted as:
   355  //
   356  //	scheme:opaque[?query][#fragment]
   357  //
   358  // The Host field contains the host and port subcomponents of the URL.
   359  // When the port is present, it is separated from the host with a colon.
   360  // When the host is an IPv6 address, it must be enclosed in square brackets:
   361  // "[fe80::1]:80". The [net.JoinHostPort] function combines a host and port
   362  // into a string suitable for the Host field, adding square brackets to
   363  // the host when necessary.
   364  //
   365  // Note that the Path field is stored in decoded form: /%47%6f%2f becomes /Go/.
   366  // A consequence is that it is impossible to tell which slashes in the Path were
   367  // slashes in the raw URL and which were %2f. This distinction is rarely important,
   368  // but when it is, the code should use the [URL.EscapedPath] method, which preserves
   369  // the original encoding of Path.
   370  //
   371  // The RawPath field is an optional field which is only set when the default
   372  // encoding of Path is different from the escaped path. See the EscapedPath method
   373  // for more details.
   374  //
   375  // URL's String method uses the EscapedPath method to obtain the path.
   376  type URL struct {
   377  	Scheme      string
   378  	Opaque      string    // encoded opaque data
   379  	User        *Userinfo // username and password information
   380  	Host        string    // host or host:port (see Hostname and Port methods)
   381  	Path        string    // path (relative paths may omit leading slash)
   382  	RawPath     string    // encoded path hint (see EscapedPath method)
   383  	OmitHost    bool      // do not emit empty host (authority)
   384  	ForceQuery  bool      // append a query ('?') even if RawQuery is empty
   385  	RawQuery    string    // encoded query values, without '?'
   386  	Fragment    string    // fragment for references, without '#'
   387  	RawFragment string    // encoded fragment hint (see EscapedFragment method)
   388  }
   389  
   390  // User returns a [Userinfo] containing the provided username
   391  // and no password set.
   392  func User(username string) *Userinfo {
   393  	return &Userinfo{username, "", false}
   394  }
   395  
   396  // UserPassword returns a [Userinfo] containing the provided username
   397  // and password.
   398  //
   399  // This functionality should only be used with legacy web sites.
   400  // RFC 2396 warns that interpreting Userinfo this way
   401  // “is NOT RECOMMENDED, because the passing of authentication
   402  // information in clear text (such as URI) has proven to be a
   403  // security risk in almost every case where it has been used.”
   404  func UserPassword(username, password string) *Userinfo {
   405  	return &Userinfo{username, password, true}
   406  }
   407  
   408  // The Userinfo type is an immutable encapsulation of username and
   409  // password details for a [URL]. An existing Userinfo value is guaranteed
   410  // to have a username set (potentially empty, as allowed by RFC 2396),
   411  // and optionally a password.
   412  type Userinfo struct {
   413  	username    string
   414  	password    string
   415  	passwordSet bool
   416  }
   417  
   418  // Username returns the username.
   419  func (u *Userinfo) Username() string {
   420  	if u == nil {
   421  		return ""
   422  	}
   423  	return u.username
   424  }
   425  
   426  // Password returns the password in case it is set, and whether it is set.
   427  func (u *Userinfo) Password() (string, bool) {
   428  	if u == nil {
   429  		return "", false
   430  	}
   431  	return u.password, u.passwordSet
   432  }
   433  
   434  // String returns the encoded userinfo information in the standard form
   435  // of "username[:password]".
   436  func (u *Userinfo) String() string {
   437  	if u == nil {
   438  		return ""
   439  	}
   440  	s := escape(u.username, encodeUserPassword)
   441  	if u.passwordSet {
   442  		s += ":" + escape(u.password, encodeUserPassword)
   443  	}
   444  	return s
   445  }
   446  
   447  // Maybe rawURL is of the form scheme:path.
   448  // (Scheme must be [a-zA-Z][a-zA-Z0-9+.-]*)
   449  // If so, return scheme, path; else return "", rawURL.
   450  func getScheme(rawURL string) (scheme, path string, err error) {
   451  	for i := 0; i < len(rawURL); i++ {
   452  		c := rawURL[i]
   453  		switch {
   454  		case 'a' <= c && c <= 'z' || 'A' <= c && c <= 'Z':
   455  		// do nothing
   456  		case '0' <= c && c <= '9' || c == '+' || c == '-' || c == '.':
   457  			if i == 0 {
   458  				return "", rawURL, nil
   459  			}
   460  		case c == ':':
   461  			if i == 0 {
   462  				return "", "", errors.New("missing protocol scheme")
   463  			}
   464  			return rawURL[:i], rawURL[i+1:], nil
   465  		default:
   466  			// we have encountered an invalid character,
   467  			// so there is no valid scheme
   468  			return "", rawURL, nil
   469  		}
   470  	}
   471  	return "", rawURL, nil
   472  }
   473  
   474  // Parse parses a raw url into a [URL] structure.
   475  //
   476  // The url may be relative (a path, without a host) or absolute
   477  // (starting with a scheme). Trying to parse a hostname and path
   478  // without a scheme is invalid but may not necessarily return an
   479  // error, due to parsing ambiguities.
   480  func Parse(rawURL string) (*URL, error) {
   481  	// Cut off #frag
   482  	u, frag, _ := strings.Cut(rawURL, "#")
   483  	url, err := parse(u, false)
   484  	if err != nil {
   485  		return nil, &Error{"parse", u, err}
   486  	}
   487  	if frag == "" {
   488  		return url, nil
   489  	}
   490  	if err = url.setFragment(frag); err != nil {
   491  		return nil, &Error{"parse", rawURL, err}
   492  	}
   493  	return url, nil
   494  }
   495  
   496  // ParseRequestURI parses a raw url into a [URL] structure. It assumes that
   497  // url was received in an HTTP request, so the url is interpreted
   498  // only as an absolute URI or an absolute path.
   499  // The string url is assumed not to have a #fragment suffix.
   500  // (Web browsers strip #fragment before sending the URL to a web server.)
   501  func ParseRequestURI(rawURL string) (*URL, error) {
   502  	url, err := parse(rawURL, true)
   503  	if err != nil {
   504  		return nil, &Error{"parse", rawURL, err}
   505  	}
   506  	return url, nil
   507  }
   508  
   509  // parse parses a URL from a string in one of two contexts. If
   510  // viaRequest is true, the URL is assumed to have arrived via an HTTP request,
   511  // in which case only absolute URLs or path-absolute relative URLs are allowed.
   512  // If viaRequest is false, all forms of relative URLs are allowed.
   513  func parse(rawURL string, viaRequest bool) (*URL, error) {
   514  	var rest string
   515  	var err error
   516  
   517  	if stringContainsCTLByte(rawURL) {
   518  		return nil, errors.New("net/url: invalid control character in URL")
   519  	}
   520  
   521  	if rawURL == "" && viaRequest {
   522  		return nil, errors.New("empty url")
   523  	}
   524  	url := new(URL)
   525  
   526  	if rawURL == "*" {
   527  		url.Path = "*"
   528  		return url, nil
   529  	}
   530  
   531  	// Split off possible leading "http:", "mailto:", etc.
   532  	// Cannot contain escaped characters.
   533  	if url.Scheme, rest, err = getScheme(rawURL); err != nil {
   534  		return nil, err
   535  	}
   536  	url.Scheme = strings.ToLower(url.Scheme)
   537  
   538  	if strings.HasSuffix(rest, "?") && strings.Count(rest, "?") == 1 {
   539  		url.ForceQuery = true
   540  		rest = rest[:len(rest)-1]
   541  	} else {
   542  		rest, url.RawQuery, _ = strings.Cut(rest, "?")
   543  	}
   544  
   545  	if !strings.HasPrefix(rest, "/") {
   546  		if url.Scheme != "" {
   547  			// We consider rootless paths per RFC 3986 as opaque.
   548  			url.Opaque = rest
   549  			return url, nil
   550  		}
   551  		if viaRequest {
   552  			return nil, errors.New("invalid URI for request")
   553  		}
   554  
   555  		// Avoid confusion with malformed schemes, like cache_object:foo/bar.
   556  		// See golang.org/issue/16822.
   557  		//
   558  		// RFC 3986, §3.3:
   559  		// In addition, a URI reference (Section 4.1) may be a relative-path reference,
   560  		// in which case the first path segment cannot contain a colon (":") character.
   561  		if segment, _, _ := strings.Cut(rest, "/"); strings.Contains(segment, ":") {
   562  			// First path segment has colon. Not allowed in relative URL.
   563  			return nil, errors.New("first path segment in URL cannot contain colon")
   564  		}
   565  	}
   566  
   567  	if (url.Scheme != "" || !viaRequest && !strings.HasPrefix(rest, "///")) && strings.HasPrefix(rest, "//") {
   568  		var authority string
   569  		authority, rest = rest[2:], ""
   570  		if i := strings.Index(authority, "/"); i >= 0 {
   571  			authority, rest = authority[:i], authority[i:]
   572  		}
   573  		url.User, url.Host, err = parseAuthority(authority)
   574  		if err != nil {
   575  			return nil, err
   576  		}
   577  	} else if url.Scheme != "" && strings.HasPrefix(rest, "/") {
   578  		// OmitHost is set to true when rawURL has an empty host (authority).
   579  		// See golang.org/issue/46059.
   580  		url.OmitHost = true
   581  	}
   582  
   583  	// Set Path and, optionally, RawPath.
   584  	// RawPath is a hint of the encoding of Path. We don't want to set it if
   585  	// the default escaping of Path is equivalent, to help make sure that people
   586  	// don't rely on it in general.
   587  	if err := url.setPath(rest); err != nil {
   588  		return nil, err
   589  	}
   590  	return url, nil
   591  }
   592  
   593  func parseAuthority(authority string) (user *Userinfo, host string, err error) {
   594  	i := strings.LastIndex(authority, "@")
   595  	if i < 0 {
   596  		host, err = parseHost(authority)
   597  	} else {
   598  		host, err = parseHost(authority[i+1:])
   599  	}
   600  	if err != nil {
   601  		return nil, "", err
   602  	}
   603  	if i < 0 {
   604  		return nil, host, nil
   605  	}
   606  	userinfo := authority[:i]
   607  	if !validUserinfo(userinfo) {
   608  		return nil, "", errors.New("net/url: invalid userinfo")
   609  	}
   610  	if !strings.Contains(userinfo, ":") {
   611  		if userinfo, err = unescape(userinfo, encodeUserPassword); err != nil {
   612  			return nil, "", err
   613  		}
   614  		user = User(userinfo)
   615  	} else {
   616  		username, password, _ := strings.Cut(userinfo, ":")
   617  		if username, err = unescape(username, encodeUserPassword); err != nil {
   618  			return nil, "", err
   619  		}
   620  		if password, err = unescape(password, encodeUserPassword); err != nil {
   621  			return nil, "", err
   622  		}
   623  		user = UserPassword(username, password)
   624  	}
   625  	return user, host, nil
   626  }
   627  
   628  // parseHost parses host as an authority without user
   629  // information. That is, as host[:port].
   630  func parseHost(host string) (string, error) {
   631  	if openBracketIdx := strings.LastIndex(host, "["); openBracketIdx > 0 {
   632  		return "", errors.New("invalid IP-literal")
   633  	} else if openBracketIdx == 0 {
   634  		// Parse an IP-Literal in RFC 3986 and RFC 6874.
   635  		// E.g., "[fe80::1]", "[fe80::1%25en0]", "[fe80::1]:80".
   636  		closeBracketIdx := strings.LastIndex(host, "]")
   637  		if closeBracketIdx < 0 {
   638  			return "", errors.New("missing ']' in host")
   639  		}
   640  
   641  		colonPort := host[closeBracketIdx+1:]
   642  		if !validOptionalPort(colonPort) {
   643  			return "", fmt.Errorf("invalid port %q after host", colonPort)
   644  		}
   645  		unescapedColonPort, err := unescape(colonPort, encodeHost)
   646  		if err != nil {
   647  			return "", err
   648  		}
   649  
   650  		hostname := host[openBracketIdx+1 : closeBracketIdx]
   651  		var unescapedHostname string
   652  		// RFC 6874 defines that %25 (%-encoded percent) introduces
   653  		// the zone identifier, and the zone identifier can use basically
   654  		// any %-encoding it likes. That's different from the host, which
   655  		// can only %-encode non-ASCII bytes.
   656  		// We do impose some restrictions on the zone, to avoid stupidity
   657  		// like newlines.
   658  		zoneIdx := strings.Index(hostname, "%25")
   659  		if zoneIdx >= 0 {
   660  			hostPart, err := unescape(hostname[:zoneIdx], encodeHost)
   661  			if err != nil {
   662  				return "", err
   663  			}
   664  			zonePart, err := unescape(hostname[zoneIdx:], encodeZone)
   665  			if err != nil {
   666  				return "", err
   667  			}
   668  			unescapedHostname = hostPart + zonePart
   669  		} else {
   670  			var err error
   671  			unescapedHostname, err = unescape(hostname, encodeHost)
   672  			if err != nil {
   673  				return "", err
   674  			}
   675  		}
   676  
   677  		// Per RFC 3986, only a host identified by a valid
   678  		// IPv6 address can be enclosed by square brackets.
   679  		// This excludes any IPv4, but notably not IPv4-mapped addresses.
   680  		addr, err := netip.ParseAddr(unescapedHostname)
   681  		if err != nil {
   682  			return "", fmt.Errorf("invalid host: %w", err)
   683  		}
   684  		if addr.Is4() {
   685  			return "", errors.New("invalid IP-literal")
   686  		}
   687  		return "[" + unescapedHostname + "]" + unescapedColonPort, nil
   688  	} else if i := strings.LastIndex(host, ":"); i != -1 {
   689  		colonPort := host[i:]
   690  		if !validOptionalPort(colonPort) {
   691  			return "", fmt.Errorf("invalid port %q after host", colonPort)
   692  		}
   693  	}
   694  
   695  	var err error
   696  	if host, err = unescape(host, encodeHost); err != nil {
   697  		return "", err
   698  	}
   699  	return host, nil
   700  }
   701  
   702  // setPath sets the Path and RawPath fields of the URL based on the provided
   703  // escaped path p. It maintains the invariant that RawPath is only specified
   704  // when it differs from the default encoding of the path.
   705  // For example:
   706  // - setPath("/foo/bar")   will set Path="/foo/bar" and RawPath=""
   707  // - setPath("/foo%2fbar") will set Path="/foo/bar" and RawPath="/foo%2fbar"
   708  // setPath will return an error only if the provided path contains an invalid
   709  // escaping.
   710  //
   711  // setPath should be an internal detail,
   712  // but widely used packages access it using linkname.
   713  // Notable members of the hall of shame include:
   714  //   - github.com/sagernet/sing
   715  //
   716  // Do not remove or change the type signature.
   717  // See go.dev/issue/67401.
   718  //
   719  //go:linkname badSetPath net/url.(*URL).setPath
   720  func (u *URL) setPath(p string) error {
   721  	path, err := unescape(p, encodePath)
   722  	if err != nil {
   723  		return err
   724  	}
   725  	u.Path = path
   726  	if escp := escape(path, encodePath); p == escp {
   727  		// Default encoding is fine.
   728  		u.RawPath = ""
   729  	} else {
   730  		u.RawPath = p
   731  	}
   732  	return nil
   733  }
   734  
   735  // for linkname because we cannot linkname methods directly
   736  func badSetPath(*URL, string) error
   737  
   738  // EscapedPath returns the escaped form of u.Path.
   739  // In general there are multiple possible escaped forms of any path.
   740  // EscapedPath returns u.RawPath when it is a valid escaping of u.Path.
   741  // Otherwise EscapedPath ignores u.RawPath and computes an escaped
   742  // form on its own.
   743  // The [URL.String] and [URL.RequestURI] methods use EscapedPath to construct
   744  // their results.
   745  // In general, code should call EscapedPath instead of
   746  // reading u.RawPath directly.
   747  func (u *URL) EscapedPath() string {
   748  	if u.RawPath != "" && validEncoded(u.RawPath, encodePath) {
   749  		p, err := unescape(u.RawPath, encodePath)
   750  		if err == nil && p == u.Path {
   751  			return u.RawPath
   752  		}
   753  	}
   754  	if u.Path == "*" {
   755  		return "*" // don't escape (Issue 11202)
   756  	}
   757  	return escape(u.Path, encodePath)
   758  }
   759  
   760  // validEncoded reports whether s is a valid encoded path or fragment,
   761  // according to mode.
   762  // It must not contain any bytes that require escaping during encoding.
   763  func validEncoded(s string, mode encoding) bool {
   764  	for i := 0; i < len(s); i++ {
   765  		// RFC 3986, Appendix A.
   766  		// pchar = unreserved / pct-encoded / sub-delims / ":" / "@".
   767  		// shouldEscape is not quite compliant with the RFC,
   768  		// so we check the sub-delims ourselves and let
   769  		// shouldEscape handle the others.
   770  		switch s[i] {
   771  		case '!', '$', '&', '\'', '(', ')', '*', '+', ',', ';', '=', ':', '@':
   772  			// ok
   773  		case '[', ']':
   774  			// ok - not specified in RFC 3986 but left alone by modern browsers
   775  		case '%':
   776  			// ok - percent encoded, will decode
   777  		default:
   778  			if shouldEscape(s[i], mode) {
   779  				return false
   780  			}
   781  		}
   782  	}
   783  	return true
   784  }
   785  
   786  // setFragment is like setPath but for Fragment/RawFragment.
   787  func (u *URL) setFragment(f string) error {
   788  	frag, err := unescape(f, encodeFragment)
   789  	if err != nil {
   790  		return err
   791  	}
   792  	u.Fragment = frag
   793  	if escf := escape(frag, encodeFragment); f == escf {
   794  		// Default encoding is fine.
   795  		u.RawFragment = ""
   796  	} else {
   797  		u.RawFragment = f
   798  	}
   799  	return nil
   800  }
   801  
   802  // EscapedFragment returns the escaped form of u.Fragment.
   803  // In general there are multiple possible escaped forms of any fragment.
   804  // EscapedFragment returns u.RawFragment when it is a valid escaping of u.Fragment.
   805  // Otherwise EscapedFragment ignores u.RawFragment and computes an escaped
   806  // form on its own.
   807  // The [URL.String] method uses EscapedFragment to construct its result.
   808  // In general, code should call EscapedFragment instead of
   809  // reading u.RawFragment directly.
   810  func (u *URL) EscapedFragment() string {
   811  	if u.RawFragment != "" && validEncoded(u.RawFragment, encodeFragment) {
   812  		f, err := unescape(u.RawFragment, encodeFragment)
   813  		if err == nil && f == u.Fragment {
   814  			return u.RawFragment
   815  		}
   816  	}
   817  	return escape(u.Fragment, encodeFragment)
   818  }
   819  
   820  // validOptionalPort reports whether port is either an empty string
   821  // or matches /^:\d*$/
   822  func validOptionalPort(port string) bool {
   823  	if port == "" {
   824  		return true
   825  	}
   826  	if port[0] != ':' {
   827  		return false
   828  	}
   829  	for _, b := range port[1:] {
   830  		if b < '0' || b > '9' {
   831  			return false
   832  		}
   833  	}
   834  	return true
   835  }
   836  
   837  // String reassembles the [URL] into a valid URL string.
   838  // The general form of the result is one of:
   839  //
   840  //	scheme:opaque?query#fragment
   841  //	scheme://userinfo@host/path?query#fragment
   842  //
   843  // If u.Opaque is non-empty, String uses the first form;
   844  // otherwise it uses the second form.
   845  // Any non-ASCII characters in host are escaped.
   846  // To obtain the path, String uses u.EscapedPath().
   847  //
   848  // In the second form, the following rules apply:
   849  //   - if u.Scheme is empty, scheme: is omitted.
   850  //   - if u.User is nil, userinfo@ is omitted.
   851  //   - if u.Host is empty, host/ is omitted.
   852  //   - if u.Scheme and u.Host are empty and u.User is nil,
   853  //     the entire scheme://userinfo@host/ is omitted.
   854  //   - if u.Host is non-empty and u.Path begins with a /,
   855  //     the form host/path does not add its own /.
   856  //   - if u.RawQuery is empty, ?query is omitted.
   857  //   - if u.Fragment is empty, #fragment is omitted.
   858  func (u *URL) String() string {
   859  	var buf strings.Builder
   860  
   861  	n := len(u.Scheme)
   862  	if u.Opaque != "" {
   863  		n += len(u.Opaque)
   864  	} else {
   865  		if !u.OmitHost && (u.Scheme != "" || u.Host != "" || u.User != nil) {
   866  			username := u.User.Username()
   867  			password, _ := u.User.Password()
   868  			n += len(username) + len(password) + len(u.Host)
   869  		}
   870  		n += len(u.Path)
   871  	}
   872  	n += len(u.RawQuery) + len(u.RawFragment)
   873  	n += len(":" + "//" + "//" + ":" + "@" + "/" + "./" + "?" + "#")
   874  	buf.Grow(n)
   875  
   876  	if u.Scheme != "" {
   877  		buf.WriteString(u.Scheme)
   878  		buf.WriteByte(':')
   879  	}
   880  	if u.Opaque != "" {
   881  		buf.WriteString(u.Opaque)
   882  	} else {
   883  		if u.Scheme != "" || u.Host != "" || u.User != nil {
   884  			if u.OmitHost && u.Host == "" && u.User == nil {
   885  				// omit empty host
   886  			} else {
   887  				if u.Host != "" || u.Path != "" || u.User != nil {
   888  					buf.WriteString("//")
   889  				}
   890  				if ui := u.User; ui != nil {
   891  					buf.WriteString(ui.String())
   892  					buf.WriteByte('@')
   893  				}
   894  				if h := u.Host; h != "" {
   895  					buf.WriteString(escape(h, encodeHost))
   896  				}
   897  			}
   898  		}
   899  		path := u.EscapedPath()
   900  		if path != "" && path[0] != '/' && u.Host != "" {
   901  			buf.WriteByte('/')
   902  		}
   903  		if buf.Len() == 0 {
   904  			// RFC 3986 §4.2
   905  			// A path segment that contains a colon character (e.g., "this:that")
   906  			// cannot be used as the first segment of a relative-path reference, as
   907  			// it would be mistaken for a scheme name. Such a segment must be
   908  			// preceded by a dot-segment (e.g., "./this:that") to make a relative-
   909  			// path reference.
   910  			if segment, _, _ := strings.Cut(path, "/"); strings.Contains(segment, ":") {
   911  				buf.WriteString("./")
   912  			}
   913  		}
   914  		buf.WriteString(path)
   915  	}
   916  	if u.ForceQuery || u.RawQuery != "" {
   917  		buf.WriteByte('?')
   918  		buf.WriteString(u.RawQuery)
   919  	}
   920  	if u.Fragment != "" {
   921  		buf.WriteByte('#')
   922  		buf.WriteString(u.EscapedFragment())
   923  	}
   924  	return buf.String()
   925  }
   926  
   927  // Redacted is like [URL.String] but replaces any password with "xxxxx".
   928  // Only the password in u.User is redacted.
   929  func (u *URL) Redacted() string {
   930  	if u == nil {
   931  		return ""
   932  	}
   933  
   934  	ru := *u
   935  	if _, has := ru.User.Password(); has {
   936  		ru.User = UserPassword(ru.User.Username(), "xxxxx")
   937  	}
   938  	return ru.String()
   939  }
   940  
   941  // Values maps a string key to a list of values.
   942  // It is typically used for query parameters and form values.
   943  // Unlike in the http.Header map, the keys in a Values map
   944  // are case-sensitive.
   945  type Values map[string][]string
   946  
   947  // Get gets the first value associated with the given key.
   948  // If there are no values associated with the key, Get returns
   949  // the empty string. To access multiple values, use the map
   950  // directly.
   951  func (v Values) Get(key string) string {
   952  	vs := v[key]
   953  	if len(vs) == 0 {
   954  		return ""
   955  	}
   956  	return vs[0]
   957  }
   958  
   959  // Set sets the key to value. It replaces any existing
   960  // values.
   961  func (v Values) Set(key, value string) {
   962  	v[key] = []string{value}
   963  }
   964  
   965  // Add adds the value to key. It appends to any existing
   966  // values associated with key.
   967  func (v Values) Add(key, value string) {
   968  	v[key] = append(v[key], value)
   969  }
   970  
   971  // Del deletes the values associated with key.
   972  func (v Values) Del(key string) {
   973  	delete(v, key)
   974  }
   975  
   976  // Has checks whether a given key is set.
   977  func (v Values) Has(key string) bool {
   978  	_, ok := v[key]
   979  	return ok
   980  }
   981  
   982  // ParseQuery parses the URL-encoded query string and returns
   983  // a map listing the values specified for each key.
   984  // ParseQuery always returns a non-nil map containing all the
   985  // valid query parameters found; err describes the first decoding error
   986  // encountered, if any.
   987  //
   988  // Query is expected to be a list of key=value settings separated by ampersands.
   989  // A setting without an equals sign is interpreted as a key set to an empty
   990  // value.
   991  // Settings containing a non-URL-encoded semicolon are considered invalid.
   992  func ParseQuery(query string) (Values, error) {
   993  	m := make(Values)
   994  	err := parseQuery(m, query)
   995  	return m, err
   996  }
   997  
   998  var urlmaxqueryparams = godebug.New("urlmaxqueryparams")
   999  
  1000  // Keep this in sync with net/http/httputil.
  1001  const defaultMaxParams = 10000
  1002  
  1003  func urlParamsWithinMax(params int) bool {
  1004  	withinDefaultMax := params <= defaultMaxParams
  1005  	if urlmaxqueryparams.Value() == "" {
  1006  		return withinDefaultMax
  1007  	}
  1008  	customMax, err := strconv.Atoi(urlmaxqueryparams.Value())
  1009  	if err != nil {
  1010  		return withinDefaultMax
  1011  	}
  1012  	withinCustomMax := customMax == 0 || params < customMax
  1013  	if withinDefaultMax != withinCustomMax {
  1014  		urlmaxqueryparams.IncNonDefault()
  1015  	}
  1016  	return withinCustomMax
  1017  }
  1018  
  1019  func parseQuery(m Values, query string) (err error) {
  1020  	if !urlParamsWithinMax(strings.Count(query, "&") + 1) {
  1021  		return errors.New("number of URL query parameters exceeded limit")
  1022  	}
  1023  	for query != "" {
  1024  		var key string
  1025  		key, query, _ = strings.Cut(query, "&")
  1026  		if strings.Contains(key, ";") {
  1027  			err = fmt.Errorf("invalid semicolon separator in query")
  1028  			continue
  1029  		}
  1030  		if key == "" {
  1031  			continue
  1032  		}
  1033  		key, value, _ := strings.Cut(key, "=")
  1034  		key, err1 := QueryUnescape(key)
  1035  		if err1 != nil {
  1036  			if err == nil {
  1037  				err = err1
  1038  			}
  1039  			continue
  1040  		}
  1041  		value, err1 = QueryUnescape(value)
  1042  		if err1 != nil {
  1043  			if err == nil {
  1044  				err = err1
  1045  			}
  1046  			continue
  1047  		}
  1048  		m[key] = append(m[key], value)
  1049  	}
  1050  	return err
  1051  }
  1052  
  1053  // Encode encodes the values into “URL encoded” form
  1054  // ("bar=baz&foo=quux") sorted by key.
  1055  func (v Values) Encode() string {
  1056  	if len(v) == 0 {
  1057  		return ""
  1058  	}
  1059  	var buf strings.Builder
  1060  	for _, k := range slices.Sorted(maps.Keys(v)) {
  1061  		vs := v[k]
  1062  		keyEscaped := QueryEscape(k)
  1063  		for _, v := range vs {
  1064  			if buf.Len() > 0 {
  1065  				buf.WriteByte('&')
  1066  			}
  1067  			buf.WriteString(keyEscaped)
  1068  			buf.WriteByte('=')
  1069  			buf.WriteString(QueryEscape(v))
  1070  		}
  1071  	}
  1072  	return buf.String()
  1073  }
  1074  
  1075  // resolvePath applies special path segments from refs and applies
  1076  // them to base, per RFC 3986.
  1077  func resolvePath(base, ref string) string {
  1078  	var full string
  1079  	if ref == "" {
  1080  		full = base
  1081  	} else if ref[0] != '/' {
  1082  		i := strings.LastIndex(base, "/")
  1083  		full = base[:i+1] + ref
  1084  	} else {
  1085  		full = ref
  1086  	}
  1087  	if full == "" {
  1088  		return ""
  1089  	}
  1090  
  1091  	var (
  1092  		elem string
  1093  		dst  strings.Builder
  1094  	)
  1095  	first := true
  1096  	remaining := full
  1097  	// We want to return a leading '/', so write it now.
  1098  	dst.WriteByte('/')
  1099  	found := true
  1100  	for found {
  1101  		elem, remaining, found = strings.Cut(remaining, "/")
  1102  		if elem == "." {
  1103  			first = false
  1104  			// drop
  1105  			continue
  1106  		}
  1107  
  1108  		if elem == ".." {
  1109  			// Ignore the leading '/' we already wrote.
  1110  			str := dst.String()[1:]
  1111  			index := strings.LastIndexByte(str, '/')
  1112  
  1113  			dst.Reset()
  1114  			dst.WriteByte('/')
  1115  			if index == -1 {
  1116  				first = true
  1117  			} else {
  1118  				dst.WriteString(str[:index])
  1119  			}
  1120  		} else {
  1121  			if !first {
  1122  				dst.WriteByte('/')
  1123  			}
  1124  			dst.WriteString(elem)
  1125  			first = false
  1126  		}
  1127  	}
  1128  
  1129  	if elem == "." || elem == ".." {
  1130  		dst.WriteByte('/')
  1131  	}
  1132  
  1133  	// We wrote an initial '/', but we don't want two.
  1134  	r := dst.String()
  1135  	if len(r) > 1 && r[1] == '/' {
  1136  		r = r[1:]
  1137  	}
  1138  	return r
  1139  }
  1140  
  1141  // IsAbs reports whether the [URL] is absolute.
  1142  // Absolute means that it has a non-empty scheme.
  1143  func (u *URL) IsAbs() bool {
  1144  	return u.Scheme != ""
  1145  }
  1146  
  1147  // Parse parses a [URL] in the context of the receiver. The provided URL
  1148  // may be relative or absolute. Parse returns nil, err on parse
  1149  // failure, otherwise its return value is the same as [URL.ResolveReference].
  1150  func (u *URL) Parse(ref string) (*URL, error) {
  1151  	refURL, err := Parse(ref)
  1152  	if err != nil {
  1153  		return nil, err
  1154  	}
  1155  	return u.ResolveReference(refURL), nil
  1156  }
  1157  
  1158  // ResolveReference resolves a URI reference to an absolute URI from
  1159  // an absolute base URI u, per RFC 3986 Section 5.2. The URI reference
  1160  // may be relative or absolute. ResolveReference always returns a new
  1161  // [URL] instance, even if the returned URL is identical to either the
  1162  // base or reference. If ref is an absolute URL, then ResolveReference
  1163  // ignores base and returns a copy of ref.
  1164  func (u *URL) ResolveReference(ref *URL) *URL {
  1165  	url := *ref
  1166  	if ref.Scheme == "" {
  1167  		url.Scheme = u.Scheme
  1168  	}
  1169  	if ref.Scheme != "" || ref.Host != "" || ref.User != nil {
  1170  		// The "absoluteURI" or "net_path" cases.
  1171  		// We can ignore the error from setPath since we know we provided a
  1172  		// validly-escaped path.
  1173  		url.setPath(resolvePath(ref.EscapedPath(), ""))
  1174  		return &url
  1175  	}
  1176  	if ref.Opaque != "" {
  1177  		url.User = nil
  1178  		url.Host = ""
  1179  		url.Path = ""
  1180  		return &url
  1181  	}
  1182  	if ref.Path == "" && !ref.ForceQuery && ref.RawQuery == "" {
  1183  		url.RawQuery = u.RawQuery
  1184  		if ref.Fragment == "" {
  1185  			url.Fragment = u.Fragment
  1186  			url.RawFragment = u.RawFragment
  1187  		}
  1188  	}
  1189  	if ref.Path == "" && u.Opaque != "" {
  1190  		url.Opaque = u.Opaque
  1191  		url.User = nil
  1192  		url.Host = ""
  1193  		url.Path = ""
  1194  		return &url
  1195  	}
  1196  	// The "abs_path" or "rel_path" cases.
  1197  	url.Host = u.Host
  1198  	url.User = u.User
  1199  	url.setPath(resolvePath(u.EscapedPath(), ref.EscapedPath()))
  1200  	return &url
  1201  }
  1202  
  1203  // Query parses RawQuery and returns the corresponding values.
  1204  // It silently discards malformed value pairs.
  1205  // To check errors use [ParseQuery].
  1206  func (u *URL) Query() Values {
  1207  	v, _ := ParseQuery(u.RawQuery)
  1208  	return v
  1209  }
  1210  
  1211  // RequestURI returns the encoded path?query or opaque?query
  1212  // string that would be used in an HTTP request for u.
  1213  func (u *URL) RequestURI() string {
  1214  	result := u.Opaque
  1215  	if result == "" {
  1216  		result = u.EscapedPath()
  1217  		if result == "" {
  1218  			result = "/"
  1219  		}
  1220  	} else {
  1221  		if strings.HasPrefix(result, "//") {
  1222  			result = u.Scheme + ":" + result
  1223  		}
  1224  	}
  1225  	if u.ForceQuery || u.RawQuery != "" {
  1226  		result += "?" + u.RawQuery
  1227  	}
  1228  	return result
  1229  }
  1230  
  1231  // Hostname returns u.Host, stripping any valid port number if present.
  1232  //
  1233  // If the result is enclosed in square brackets, as literal IPv6 addresses are,
  1234  // the square brackets are removed from the result.
  1235  func (u *URL) Hostname() string {
  1236  	host, _ := splitHostPort(u.Host)
  1237  	return host
  1238  }
  1239  
  1240  // Port returns the port part of u.Host, without the leading colon.
  1241  //
  1242  // If u.Host doesn't contain a valid numeric port, Port returns an empty string.
  1243  func (u *URL) Port() string {
  1244  	_, port := splitHostPort(u.Host)
  1245  	return port
  1246  }
  1247  
  1248  // splitHostPort separates host and port. If the port is not valid, it returns
  1249  // the entire input as host, and it doesn't check the validity of the host.
  1250  // Unlike net.SplitHostPort, but per RFC 3986, it requires ports to be numeric.
  1251  func splitHostPort(hostPort string) (host, port string) {
  1252  	host = hostPort
  1253  
  1254  	colon := strings.LastIndexByte(host, ':')
  1255  	if colon != -1 && validOptionalPort(host[colon:]) {
  1256  		host, port = host[:colon], host[colon+1:]
  1257  	}
  1258  
  1259  	if strings.HasPrefix(host, "[") && strings.HasSuffix(host, "]") {
  1260  		host = host[1 : len(host)-1]
  1261  	}
  1262  
  1263  	return
  1264  }
  1265  
  1266  // Marshaling interface implementations.
  1267  // Would like to implement MarshalText/UnmarshalText but that will change the JSON representation of URLs.
  1268  
  1269  func (u *URL) MarshalBinary() (text []byte, err error) {
  1270  	return u.AppendBinary(nil)
  1271  }
  1272  
  1273  func (u *URL) AppendBinary(b []byte) ([]byte, error) {
  1274  	return append(b, u.String()...), nil
  1275  }
  1276  
  1277  func (u *URL) UnmarshalBinary(text []byte) error {
  1278  	u1, err := Parse(string(text))
  1279  	if err != nil {
  1280  		return err
  1281  	}
  1282  	*u = *u1
  1283  	return nil
  1284  }
  1285  
  1286  // JoinPath returns a new [URL] with the provided path elements joined to
  1287  // any existing path and the resulting path cleaned of any ./ or ../ elements.
  1288  // Any sequences of multiple / characters will be reduced to a single /.
  1289  func (u *URL) JoinPath(elem ...string) *URL {
  1290  	elem = append([]string{u.EscapedPath()}, elem...)
  1291  	var p string
  1292  	if !strings.HasPrefix(elem[0], "/") {
  1293  		// Return a relative path if u is relative,
  1294  		// but ensure that it contains no ../ elements.
  1295  		elem[0] = "/" + elem[0]
  1296  		p = path.Join(elem...)[1:]
  1297  	} else {
  1298  		p = path.Join(elem...)
  1299  	}
  1300  	// path.Join will remove any trailing slashes.
  1301  	// Preserve at least one.
  1302  	if strings.HasSuffix(elem[len(elem)-1], "/") && !strings.HasSuffix(p, "/") {
  1303  		p += "/"
  1304  	}
  1305  	url := *u
  1306  	url.setPath(p)
  1307  	return &url
  1308  }
  1309  
  1310  // validUserinfo reports whether s is a valid userinfo string per RFC 3986
  1311  // Section 3.2.1:
  1312  //
  1313  //	userinfo    = *( unreserved / pct-encoded / sub-delims / ":" )
  1314  //	unreserved  = ALPHA / DIGIT / "-" / "." / "_" / "~"
  1315  //	sub-delims  = "!" / "$" / "&" / "'" / "(" / ")"
  1316  //	              / "*" / "+" / "," / ";" / "="
  1317  //
  1318  // It doesn't validate pct-encoded. The caller does that via func unescape.
  1319  func validUserinfo(s string) bool {
  1320  	for _, r := range s {
  1321  		if 'A' <= r && r <= 'Z' {
  1322  			continue
  1323  		}
  1324  		if 'a' <= r && r <= 'z' {
  1325  			continue
  1326  		}
  1327  		if '0' <= r && r <= '9' {
  1328  			continue
  1329  		}
  1330  		switch r {
  1331  		case '-', '.', '_', ':', '~', '!', '$', '&', '\'',
  1332  			'(', ')', '*', '+', ',', ';', '=', '%':
  1333  			continue
  1334  		case '@':
  1335  			// `RFC 3986 section 3.2.1` does not allow '@' in userinfo.
  1336  			// It is a delimiter between userinfo and host.
  1337  			// However, URLs are diverse, and in some cases,
  1338  			// the userinfo may contain an '@' character,
  1339  			// for example, in "http://username:p@ssword@google.com",
  1340  			// the string "username:p@ssword" should be treated as valid userinfo.
  1341  			// Ref:
  1342  			//   https://go.dev/issue/3439
  1343  			//   https://go.dev/issue/22655
  1344  			continue
  1345  		default:
  1346  			return false
  1347  		}
  1348  	}
  1349  	return true
  1350  }
  1351  
  1352  // stringContainsCTLByte reports whether s contains any ASCII control character.
  1353  func stringContainsCTLByte(s string) bool {
  1354  	for i := 0; i < len(s); i++ {
  1355  		b := s[i]
  1356  		if b < ' ' || b == 0x7f {
  1357  			return true
  1358  		}
  1359  	}
  1360  	return false
  1361  }
  1362  
  1363  // JoinPath returns a [URL] string with the provided path elements joined to
  1364  // the existing path of base and the resulting path cleaned of any ./ or ../ elements.
  1365  func JoinPath(base string, elem ...string) (result string, err error) {
  1366  	url, err := Parse(base)
  1367  	if err != nil {
  1368  		return
  1369  	}
  1370  	result = url.JoinPath(elem...).String()
  1371  	return
  1372  }
  1373  

View as plain text