percent-encoding

The URL Standard defines URLs, domains, IP addresses, the application/x-www-form-urlencoded format, and their API. Align RFC 3986 and RFC 3987 with contemporary implementations and obsolete the RFCs in the process. (E.g., spaces, other "illegal" code points, query encoding, equality, canonicalization, are all concepts not entirely shared, or defined.) URL parsing needs to become as solid as HTML parsing. [[RFC3986]]( "Uniform Resource Identifier (URI): Generic Syntax") [[RFC3987]]( "Internationalized Resource Identifiers (IRIs)") Supplanting [Origin of a URI [sic]]( . [[RFC6454]]( "The Web Origin Concept") Define URL’s existing JavaScript API in full detail and add enhancements to make it easier to work with. Add a new URL object as well for URL manipulation without usage of HTML elements. (Useful for JavaScript worker environments.) Ensure the combination of parser, serializer, and API guarantee idempotence. For example, a non-failure result of a parse-then-serialize operation will not change with any further parse-then-serialize operations applied to it. Similarly, manipulating a non-failure result through the API will not change from applying any number of serialize-then-parse operations to it. As the editors learn more about the subject matter the goals might increase in scope somewhat. A validation error indicates a mismatch between input and valid input. User agents, especially conformance checkers, are encouraged to report them somewhere. The EOF code point is a conceptual code point that signifies the end of a string or code point stream. Using anything but UTF-8 decode without BOM when input contains bytes that are not ASCII bytes might be insecure and is not recommended. In general, percent-encoding results in a string with more U+0025 (%) code points than the input, and percent-decoding results in a byte sequence with less 0x25 (%) bytes than the input. The special-query percent-encode set is a percent-encode set consisting of the query percent-encode set and U+0027 ('). 2. Set potentialError to the result of running encode or fail with inputQueue, encoder, and encodeOutput. To UTF-8 percent-encode a scalar value string input using a percentEncodeSet, return the result of running percent-encode after encoding with UTF-8 , input, and percentEncodeSet. When rendering and allocating new URLs "spoofing" needs to be considered. An attack whereby one host or URL can be confused for another. For instance, consider how 1/l/I, m/rn/rri, 0/O, and а/a can all appear eerily similar. Or worse, consider how U+202A LEFT-TO-RIGHT EMBEDDING and similar code points are invisible. [[UTR36]]( "Unicode Security Considerations") The host parser takes an arbitrary scalar value string and returns either failure or a host . The host serializer takes a host and returns an ASCII string . (If that string is then parsed , the result will equal the host that was serialized .) The RFCs referenced in the paragraphs below are for informative purposes only. They have no influence on host writing, parsing, and serialization. Unless stated otherwise in the sections that follow. The example.com and example.com. domains are not equivalent and typically treated as distinct. An IPv4 address is a 32-bit unsigned integer that identifies a network address. [[RFC791]]( "Internet Protocol")