Standard compliant URL host punctuation characters

Category: Miscellaneous
Type: Chromium catches up
Status: Enabled by default (Chrome 119)
Intent stage: None

Breaking change: Yes
Enterprise impact: None
Spec maturity: Published standard
Web Platform Tests: Yes

WPT details: The following tests are introduced in WPT https://wpt.fyi/results/url/a-element-origin.html?label=master&label=experimental&aligned: Parsing origin: <http://!"$&'()*+,-.;=_`{}~/> against <about:blank> Parsing origin: <wss://!"$&'()*+,-.;=_`{}~/> against <about:blank>

Summary

Make Chrome's handling of URL host punctuation characters standard compliant. Examples: Before: > const url = new URL("http://exa(mple.com";); > url.href 'http://exa%28mple.com/' '(' is a forbidden character, however, Chrome permits it wrongly. After: > const url = new URL("http://exa(mple.com";); > => throws TypeError: Invalid URL. Before: > const url = new URL("http://exa!mple.com";); > url.href "http://exa%2Ample.com"; '!' is permitted, but escaping punctuation characters is non-compliant. After: > const url = new URL("http://exa!mple.com";); > url.href "http://exa!mple.com"; Here is a the summary of changes in M119: Notation: - 'ESC': Allowed, but Chrome escapes it, which is non-compliant. - '-': Allowed. - '0': Forbidden. URL will be invalid if the host contains a forbidden character. Warning: SPACE and ASTERISK is still non-compliant. | | Before | After | Standard | |-----+--------+-------+----------| | SPC | ESC | ESC | 0 | | ! | ESC | - | - | | " | ESC | - | - | | # | ESC | 0 | 0 | | $ | ESC | - | - | | & | ESC | - | - | | ' | ESC | - | - | | ( | ESC | - | - | | ) | ESC | - | - | | * | ESC | ESC | - | | + | - | - | - | | , | ESC | - | - | | - | - |

Standards & signals

Specification: https://url.spec.whatwg.org/#host-writing
Firefox: Positive — The forbidden characters are partially followed in firefox. '*' is considered as an invalid character in hostnames. The characters are not percent escaped in the hostnames.
Safari: Shipped/Shipping — Safari strictly follows the forbidden character list and never percent escape the characters in the hostnames.
Web developers: No signals
Tracking bug: https://crbug.com/1416013

Ecosystem

Web Platform Tests: https://wpt.fyi/results/?q=url%2Fa-element-origin
Chrome Platform Showcase: https://chrome-platform-showcase.paulkinlan-ea.deno.net/features
GenDN reference: https://gendn.paulkinlan-ea.deno.net/features
chrome.dev demos search: https://www.google.com/search?q=site%3Achrome.dev+Standard%20compliant%20URL%20host%20punctuation%20characters
MDN Web Docs: https://developer.mozilla.org/en-US/search?q=Standard%20compliant%20URL%20host%20punctuation%20characters
Baseline status: https://webstatus.dev/?q=Standard%20compliant%20URL%20host%20punctuation%20characters

Samples: https://chromium-review.googlesource.com/c/chromium/src/+/4875754

View on chromestatus.com