561586 - <input type='url'> should check URLs according to URL Standard

Status: NEW

(Core :: DOM: Forms, defect)

Description

[Mounir Lamouri (:mounir)]

At the moment, <input type='url'> type mismatch constraint validation is using |nsIIOService::NewURI| which not checking URI according to RFC's 3986 and 3987, AFAICT.

Comment 1

[Ben Bucksch (:BenB)]

You mean NewURI should do more checks? That's bug 19313.

Please note, however, that NewURI only succeeds for URL schemes that are registered on the user's system. If the user doesn't have a handler for e.g. tel: or mailto:, it fails, IIRC.

Comment 3

[Anne (:annevk)]

This might be good to look into once we implement the URL Standard better.

Comment 4

[Valentin Gosu [:valentin] (he/him)]

Our URL standard implementation is now really good, with 97% on the interop score - we're aiming for 99-100 by the end of the year.
Looking at the example code in https://html.spec.whatwg.org/multipage/input.html#url-state-(type%3Durl) in both Chrome and Firefox, I see Chrome's implementation is really close to the reference image - while Firefox doesn't provide suggestions at all.

Clearing priority so this issue gets retriaged.

Comment 5

[Peter Van der Beken [:peterv]]

This isn't really about the suggestions UI, but about validating URL strings. I made a testcase based on https://searchfox.org/mozilla-central/rev/2c3d657cbba5484ccac44443c4417baed7b5fafb/testing/web-platform/tests/conformance-checkers/tools/url.py and it looks like we're still allowing a number of things that shouldn't be allowed (missing // after the scheme for special schemes, non-digit in port, whitespace in various pieces, …).

Comment 6

[Peter Van der Beken [:peterv]]

Attachment: Validation of URL testcase

Comment 7

[Peter Van der Beken [:peterv]]

To be clear, all the inputs in attachment 9377381 [details] should be green I think.

Comment 8

[Peter Van der Beken [:peterv]]

Attachment: Validation of URL testcase

The value sanitization algorithm for type=url does strip newlines, so the values containing newlines are actually valid.

Comment 9

[Peter Van der Beken [:peterv]]

Attachment: WIP: Bug 561586 - Add some wpt tests for constraint validation for <input type="url".