From: 1911860538 <alxps1911@gmail.com>
Date: Fri, 11 Apr 2025 15:14:11 +0000 (+0000)
Subject: net/url: clarify why @ is allowed in userinfo
X-Git-Tag: go1.25rc1~457
X-Git-Url: http://www.git.cypherpunks.su/?a=commitdiff_plain;h=548dcfea1aa3dfbc975a417dc609c4f372a03042;p=gostls13.git

net/url: clarify why @ is allowed in userinfo

Add comment to clarify why '@' is allowed in validUserinfo func.

Change-Id: Ia9845bc40fea6c34093434d57bb1be4ddbc70b84
GitHub-Last-Rev: ce65168ab03afd879ad028de295f6adb7ee1c97d
GitHub-Pull-Request: golang/go#73195
Reviewed-on: https://go-review.googlesource.com/c/go/+/663455
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Damien Neil <dneil@google.com>
Auto-Submit: Damien Neil <dneil@google.com>
---

diff --git a/src/net/url/url.go b/src/net/url/url.go
index 8786d9655b..2a57659460 100644
--- a/src/net/url/url.go
+++ b/src/net/url/url.go
@@ -1280,7 +1280,18 @@ func validUserinfo(s string) bool {
 		}
 		switch r {
 		case '-', '.', '_', ':', '~', '!', '$', '&', '\'',
-			'(', ')', '*', '+', ',', ';', '=', '%', '@':
+			'(', ')', '*', '+', ',', ';', '=', '%':
+			continue
+		case '@':
+			// `RFC 3986 section 3.2.1` does not allow '@' in userinfo.
+			// It is a delimiter between userinfo and host.
+			// However, URLs are diverse, and in some cases,
+			// the userinfo may contain an '@' character,
+			// for example, in "http://username:p@ssword@google.com",
+			// the string "username:p@ssword" should be treated as valid userinfo.
+			// Ref:
+			//   https://go.dev/issue/3439
+			//   https://go.dev/issue/22655
 			continue
 		default:
 			return false