A url.URL with OmitHost=true and a Path starting with // will surprisingly stringify as a URL with an authority (host) component:
u := url.URL{
OmitHost: true,
Scheme: "file",
Path: "//host/path",
}
fmt.Println(u.String()) // file://host/pathOmitHost is only expected to be set for URLs with a Path starting with a single /(it exists entirely to handle this particular form of URL). url.Parse will never create a URL like the above. However, it's possible to manually construct one, and the results are surprising.
Perhaps we should escape the initial / in the path in this situation.
(This was reported to us as a potential vulnerability. We consider misbehavior in url.Parse to be a potential vulnerability, but not a user-constructed invalid url.URL such as the one above.)
A url.URL with OmitHost=true and a Path starting with
//will surprisingly stringify as a URL with an authority (host) component:OmitHost is only expected to be set for URLs with a Path starting with a single
/(it exists entirely to handle this particular form of URL). url.Parse will never create a URL like the above. However, it's possible to manually construct one, and the results are surprising.Perhaps we should escape the initial
/in the path in this situation.(This was reported to us as a potential vulnerability. We consider misbehavior in url.Parse to be a potential vulnerability, but not a user-constructed invalid url.URL such as the one above.)