v157 · miscellaneous · url parsing

Disallow spaces in non-file:// URL hosts

The URL Standard has always listed the space as a forbidden host code point, and Chromium has always accepted it anyway. Chrome 157 stops: new URL("https://exa mple.com/") now throws, the same as it does in Firefox and Safari, closing a long-standing Interop gap in the URL and WebSocket test suites. file:// URLs keep their spaces, because file paths legitimately contain them.

concepts

  1. Live host parser

    Type any URL and watch new URL() take it apart in real time — scheme, host, port, path — or refuse it. A built-in suite of edge cases covers the space in each position, the file:// exemption, and the encodings that stay legal.

  2. Where a space is legal

    A space is forbidden in the host, tolerated and encoded in the path, and meaningful in the query. Move one space through every component of the same URL and see what the parser does with it in each place.

  3. Migration scanner

    Paste a list of URLs — a config file, a redirect map, a CSV column — and get back which ones Chrome 157 will reject, why, and the corrected form. Runs entirely in the page.

  4. Do the parsers agree?

    The same host string through new URL(), an anchor element's href, fetch()'s request parsing, and the WebSocket constructor. Before this change they could disagree; the point of shipping it is that they no longer do.

why it shipped

Chromium accepting spaces in hosts made it fail a run of Web Platform Tests in the URL and WebSocket focus areas, both of which were Interop priorities. Worse than the test failures, it meant a URL could mean one thing in Chrome and another everywhere else — the exact condition that turns a parsing quirk into a security bug, because a validator and a fetcher can disagree about which host they are looking at.

The compatibility risk is small and one-sided: a host with a space in it was never reachable, so the URLs that start throwing were already broken. They just failed later, and less clearly.

the API

// Chrome 157 and every other engine:
new URL("https://exa mple.com/");   // TypeError: Failed to construct 'URL'
new URL("file://exa mple/path");    // fine — file:// keeps its spaces
new URL("https://exa%20mple.com/"); // fine — percent-encoded, and a real host

// The check is the URL Standard's forbidden host code point set:
// U+0000, U+0009, U+000A, U+000D, U+0020, "#", "/", ":", "<", ">",
// "?", "@", "[", "\", "]", "^", and "|".

references