diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/net/url/url.go | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/src/net/url/url.go b/src/net/url/url.go index 8786d9655b..2a57659460 100644 --- a/src/net/url/url.go +++ b/src/net/url/url.go @@ -1280,7 +1280,18 @@ func validUserinfo(s string) bool { } switch r { case '-', '.', '_', ':', '~', '!', '$', '&', '\'', - '(', ')', '*', '+', ',', ';', '=', '%', '@': + '(', ')', '*', '+', ',', ';', '=', '%': + continue + case '@': + // `RFC 3986 section 3.2.1` does not allow '@' in userinfo. + // It is a delimiter between userinfo and host. + // However, URLs are diverse, and in some cases, + // the userinfo may contain an '@' character, + // for example, in "http://username:p@ssword@google.com", + // the string "username:p@ssword" should be treated as valid userinfo. + // Ref: + // https://go.dev/issue/3439 + // https://go.dev/issue/22655 continue default: return false |