From: singpolyma@... Date: 2019-07-03T00:27:33+00:00 Subject: [ruby-core:93505] [Ruby master Bug#15979] URI.parse does not validate components Issue #15979 has been reported by singpolyma (Stephen Paul Weber). ---------------------------------------- Bug #15979: URI.parse does not validate components https://bugs.ruby-lang.org/issues/15979 * Author: singpolyma (Stephen Paul Weber) * Status: Open * Priority: Normal * Assignee: * Target version: * ruby -v: * Backport: 2.4: UNKNOWN, 2.5: UNKNOWN, 2.6: UNKNOWN ---------------------------------------- ``` ruby URI.parse("https://-._~%2C!$&'()*+,;=:@-._~%2C!$&'()*+,;=:/foo?/-._~%2C!$&'()*+,;=:@/?") ``` happily return a `URI::HTTPS` object, even though it has an invalid component and cannot be constructed using `URI::HTTPS.build` This is because the parser uses the undocumented initializer which defaults to not validating the components. I would suggest to send that initializer the flag to allow validation or to use the build method instead from the parser. -- https://bugs.ruby-lang.org/ Unsubscribe: <mailto:ruby-core-request@ruby-lang.org?subject=unsubscribe> <http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>