-
Notifications
You must be signed in to change notification settings - Fork 156
Open
Labels
Description
I've discovered an interesting behavior in the WHATWG URL specification: Windows file paths such as C:\path\file.node are considered valid URLs.
The issue
- Security: Web apps might accidentally treat file paths as URLs
- UX: Users expect
C:\path\fileto be a local file, not a URL - Consistency: Other OS paths aren't treated as URLs
Current vs Proposed
// Now
URL.canParse("C:\\path\\file.node") // true
//Should be
URL.canParse("C:\\path\\file.node") // false
URL.canParse("file:///C:/path/file.node") // trueRelated Issues
- Node.js PR #58578: "node-api: preserve URL filenames without conversion" (node-api: preserve URL filenames without conversion nodejs/node#58578)
- ada-url PR #957: "fix: reject Windows file paths in can_parse" (fix: reject Windows file paths in can_parse ada-url/ada#957)