Standard compliant URL host punctuation characters

Category: Miscellaneous
Type: Chromium catches up
Status: Enabled by default (Chrome 119)
Intent stage: None

Summary

Make Chrome's handling of URL host punctuation characters standard compliant. Examples: Before: > const url = new URL("http://exa(mple.com";); > url.href 'http://exa%28mple.com/' '(' is a forbidden character, however, Chrome permits it wrongly. After: > const url = new URL("http://exa(mple.com";); > => throws TypeError: Invalid URL. Before: > const url = new URL("http://exa!mple.com";); > url.href "http://exa%2Ample.com"; '!' is permitted, but escaping punctuation characters is non-compliant. After: > const url = new URL("http://exa!mple.com";); > url.href "http://exa!mple.com"; Here is a the summary of changes in M119: Notation: - 'ESC': Allowed, but Chrome escapes it, which is non-compliant. - '-': Allowed. - '0': Forbidden. URL will be invalid if the host contains a forbidden character. Warning: SPACE and ASTERISK is still non-compliant. | | Before | After | Standard | |-----+--------+-------+----------| | SPC | ESC | ESC | 0 | | ! | ESC | - | - | | " | ESC | - | - | | # | ESC | 0 | 0 | | $ | ESC | - | - | | & | ESC | - | - | | ' | ESC | - | - | | ( | ESC | - | - | | ) | ESC | - | - | | * | ESC | ESC | - | | + | - | - | - | | , | ESC | - | - | | - | - |

Standards & signals

Specification: https://url.spec.whatwg.org/#host-writing
Firefox: Positive — The forbidden characters are partially followed in firefox. '*' is considered as an invalid character in hostnames. The characters are not percent escaped in the hostnames.
Safari: Shipped/Shipping — Safari strictly follows the forbidden character list and never percent escape the characters in the hostnames.
Web developers: No signals
Tracking bug: https://crbug.com/1416013

Samples: https://chromium-review.googlesource.com/c/chromium/src/+/4875754

View on chromestatus.com