net/url: clarify why @ is allowed in userinfo

Add comment to clarify why '@' is allowed in validUserinfo func.

Change-Id: Ia9845bc40fea6c34093434d57bb1be4ddbc70b84
GitHub-Last-Rev: ce65168ab03afd879ad028de295f6adb7ee1c97d
GitHub-Pull-Request: golang/go#73195
Reviewed-on: https://go-review.googlesource.com/c/go/+/663455
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Damien Neil <dneil@google.com>
Auto-Submit: Damien Neil <dneil@google.com>

diff --git a/src/net/url/url.go b/src/net/url/url.go
index 8786d9655b1b502407215c6adfe2354ece669dbd..2a57659460373d0f6b7820fe9be121e00bf2e02e 100644 (file)
--- a/src/net/url/url.go
+++ b/src/net/url/url.go
@@ -1280,7 +1280,18 @@ func validUserinfo(s string) bool {
                }
                switch r {
                case '-', '.', '_', ':', '~', '!', '$', '&', '\'',
-                       '(', ')', '*', '+', ',', ';', '=', '%', '@':
+                       '(', ')', '*', '+', ',', ';', '=', '%':
+                       continue
+               case '@':
+                       // `RFC 3986 section 3.2.1` does not allow '@' in userinfo.
+                       // It is a delimiter between userinfo and host.
+                       // However, URLs are diverse, and in some cases,
+                       // the userinfo may contain an '@' character,
+                       // for example, in "http://username:p@ssword@google.com",
+                       // the string "username:p@ssword" should be treated as valid userinfo.
+                       // Ref:
+                       //   https://go.dev/issue/3439
+                       //   https://go.dev/issue/22655
                        continue
                default:
                        return false