URL validity change between 2.2 and 2.3.

[mhammond]

The URL https://www.42x.42/ parses in version 2.2 of the crate but in 2.3 fails with InvalidIpv4Address. Reading https://url.spec.whatwg.org/#concept-ipv4-parser, my naive reading implies parsing this as ipv4 is correct as the domain ends with numbers. However, curl 8 doesn't agree (it attempts to resolve the host) and up until recently Firefox didn't either (it now does because it's on url 2.5 :)

What I'm less clear on is whether this change was intentional in a minor version bump - the fact this URL no longer works in Firefox was surprising and has a number of implications (eg, databases which carefully store only validated URLs now need to deal with the possibility some stored URLs are actually invalid, etc)

If it was intentional, is there any policy for such changes? I can't see where changes to parsing semantics was called out in either the docs or the upgrading notes, so I'm wondering if there's some way we should have know to expect this kind of change in this kind of version bump?

[valenting]

Hi Mark,

The Firefox changes come from 1723456 - Reject non-IPv4 hostnames that end in numbers.
The rust-url changes you mention landed in Align IPv4 parsing to spec by lucacasonato · Pull Request 753 · servorust-url
The fact that we started using rust-url in Firefox recently for non-special schemes is coincidental.

This all comes from the URL standard changes Reject non-IPv4 hostnames that end in numbers. by MattMenke2 · Pull Request 619 · whatwgurl
These changes are now implemented in all web browsers as far as I can tell - and were mostly driven by interop see https://wpt.fyi/interop-2023?feature=interop-2023-url.

What I'm less clear on is whether this change was intentional in a minor version bump - the fact this URL no longer works in Firefox was surprising and has a number of implications (eg, databases which carefully store only validated URLs now need to deal with the possibility some stored URLs are actually invalid, etc)

That is an unfortunate side effect. Thankfully this kind of URLs are pretty rare on the web.

[mhammond]

Thanks for the detailed explanation!