[SR-15738] URL - overlapping fragment and password

[karwa]

Previous ID	SR-15738
Radar	None
Original Reporter	@karwa
Type	Bug

Environment

Xcode 13.2.1, macOS 11.6

Additional Detail from JIRA

Votes	0
Component/s	Foundation
Labels	Bug
Assignee	None
Priority	Medium

md5: 1ed93fb3f3e385e4d94f703fcfcc3fa0

Issue Description:

let url = URL(string: "Ittp://]0#::[@")!

print(url)          // "Ittp://%5D0#::%5B@"
print(url.host).    // "]0"
print(url.password) // ":%5B"
print(url.fragment) // "::%5B@"

Firstly, "]0" is not a valid hostname so it's unclear why Foundation even accepts it (unescaped square brackets are not allowed by RFC-2396. This was amended by RFC-2732, which allowed them only for the reserved purpose of delimiting IPv6 addresses).

FWIW, WebURL handles this correctly.

let url = WebURL("Ittp://]0#::[@") // nil (hostname not valid)

let url = WebURL("Ittp://%5D0#::%5B@")!

print(url)          // "Ittp://%5D0#::%5B@"
print(url.hostname) // "%5D0"
print(url.password) // nil
print(url.fragment) // "::%5B@"

[karwa]

I've just discovered that this only happens on Apple platforms; Linux and Windows don't seem to have this bug.