[ruby-core:114098] [Ruby master Bug#19756] URI::HTTP.build does not accept a host of `_gateway`, but `URI.parse` will.

Issue #19756 has been updated by jeremyevans0 (Jeremy Evans).


Dan0042 (Daniel DeLorme) wrote in #note-7:
> While all this is technically true and correct, I am not particularly interested in "what is permitted"; I think "what actually exists in the real world out there" is the only thing worth caring about.
> 
> The robustness principle is "be conservative in what you do, be liberal in what you accept from others".

The robustness principle should only be used in the case where there is not an official standard. In the cases where there is an official standard, applying the robustness principle to support non-standard implementations is actively harmful and results in systems being made worse by being forced to tolerate bugs in non-standard implementations.  Workarounds to tolerate bugs in non-standard implementations can be a source of security vulnerabilities.  Additional discussion:

* https://www.ietf.org/archive/id/draft-iab-protocol-maintenance-05.html
* https://queue.acm.org/detail.cfm?id=1999945

There may be cases where non-standard usage is so widespread that you are forced to tolerate it as a de facto standard, but this does not appear to be one of those cases.

That being said, let me summarize my research on this issue. DNS allows underscores in DNS names, but that does not necessarily apply to URLs.  The current URL spec at  https://url.spec.whatwg.org/ does not seem to exclude underscore in host name part of a URL (it could be part of an `opaque host`).  The current HTTP RFC (RFC 7231) does not seem to exclude them either. If you follow the references:

* https://datatracker.ietf.org/doc/html/rfc7231#section-5.1
* https://datatracker.ietf.org/doc/html/rfc7230#appendix-B (uri-host)
* https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2

While RFC 3986 states that host names are intended for DNS lookup using the syntax in Section 3.5 of RFC1034 and Section 2.1 of RFC1123, it also states

```
   This specification does not mandate a particular registered name
   lookup technology and therefore does not restrict the syntax of reg-
   name beyond what is necessary for interoperability.
```

The ABNF syntax given in RFC 3986 is:

```
  reg-name    = *( unreserved / pct-encoded / sub-delims )
  unreserved    = ALPHA / DIGIT / "-" / "." / "_" / "~"
```

Which indicates that underscores is a valid character in an HTTP hostname.  There is no requirement that HTTP use DNS for registered name lookup, and therefore it seems reasonable to allow underscores in host names in `URI::HTTP.build`.

----------------------------------------
Bug #19756: URI::HTTP.build does not accept a host of `_gateway`, but `URI.parse` will.
https://bugs.ruby-lang.org/issues/19756#change-103774

* Author: postmodern (Hal Brodigan)
* Status: Open
* Priority: Normal
* ruby -v: ruby 3.2.2 (2023-03-30 revision e51014f9c0) [x86_64-linux]
* Backport: 3.0: UNKNOWN, 3.1: UNKNOWN, 3.2: UNKNOWN
----------------------------------------
I noticed a difference in behavior between `URI::HTTP.build` and `URI.parse`. `URI::HTTP.build` will not accept `host:` value of `_gateway`, but `URI.parse` will.

## Steps To Reproduce

```ruby
URI::HTTP.build(host: "_gateway")
```
vs.
```ruby
URI.parse("http://_gateway")
```

### Expected Results

Both raise the same exception, or return the same URI object.

### Actual Results

```
URI::HTTP.build(host: "_gateway")
/usr/share/ruby/uri/generic.rb:601:in `check_host': bad component(expected host component): _gateway (URI::InvalidComponentError)
	from /usr/share/ruby/uri/generic.rb:640:in `host='
	from /usr/share/ruby/uri/generic.rb:673:in `hostname='
	from /usr/share/ruby/uri/generic.rb:190:in `initialize'
	from /usr/share/ruby/uri/generic.rb:136:in `new'
	from /usr/share/ruby/uri/generic.rb:136:in `build'
	from /usr/share/ruby/uri/http.rb:61:in `build'
	from (irb):2:in `<main>'
	from /usr/local/share/gems/gems/irb-1.7.0/exe/irb:9:in `<top (required)>'
	from /usr/local/bin/irb:25:in `load'
	from /usr/local/bin/irb:25:in `<main>'
```

```
URI.parse("https://_gateway")
# => #<URI::HTTPS https://_gateway>
```

## Additional Information

```
$ gem list uri
uri (default: 0.12.1)
```



-- 
https://bugs.ruby-lang.org/
 ______________________________________________
 ruby-core mailing list -- [e-mail]
 To unsubscribe send an email to [e-mail]
 ruby-core info -- https://ml.ruby-lang.org/mailman3/postorius/lists/ruby-core.ml.ruby-lang.org/