Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Libcurl gets a URL API

daniel.haxx.se

Post reply on HN
Print view View original

1–10 of 11 posts

Re: Libcurl gets a URL API

#2

Post by taf2 »

This is really excellent, it’s the main thing that curb the ruby binding I work on never felt right. We used ruby URL for the parsing and as it turns out it’s slightly less forgiving than libcurls internal parser.

Re: Libcurl gets a URL API

#3

Post by kmike84 »

The blog post mentions WHATWG URL spec and RFC 3986 - what is libcurl's URL parser implementing, what is its goal?

By the way, parsing of URLs is a large-ish task; it'd be nice to have URL API in a separate library, which libcurl depends on, and which can be used without libcurl.

Re: Libcurl gets a URL API

#4

Post by EvilTerran »

kmike84 wrote: post #3

The blog post mentions WHATWG URL spec and RFC 3986 - what is libcurl's URL parser implementing, what is its goal? By the way, parsing of URLs is a large-ish task; it'd be nice to have URL API in a separate library, which libcurl depends on, and which can be used without libcurl.

> what is libcurl's URL parser implementing, what is its goal?

I get the impression the goal would be "parsing whatever users expect to be able to use as a URL in practice". He's written before about the difficulty of pinning down "the syntax of URLs":

https://daniel.haxx.se/blog/2016/05/11/my-url-isnt-your-url/

Re: Libcurl gets a URL API

#7

Post by rpdillon »

EdSchouten wrote: post #5

Serious question: what's the value of using this over https://uriparser.github.io/ ?

It will be consistent with the logic used by the codebase that actually fetches the URL (curl), so it won't leave gaps between the expected behavior and actual behavior the way two disjoint implementations would.

Re: Libcurl gets a URL API

#9

Post by discreditable »

EdSchouten wrote: post #5

Serious question: what's the value of using this over https://uriparser.github.io/ ?

From the article:

> By offering applications access to libcurl's own URL parser, we hope to tighten a problematic vulnerable area for applications where the URL parser library would believe one thing and libcurl another. This could and has sometimes lead to security problems. (See for example Exploiting URL Parser in Trending Programming Languages! by Orange Tsai)

Post reply on HN