- 
                Notifications
    
You must be signed in to change notification settings  - Fork 155
 
Open
Labels
Description
I've discovered an interesting behavior in the WHATWG URL specification: Windows file paths such as C:\path\file.node are considered valid URLs.
The issue
- Security: Web apps might accidentally treat file paths as URLs
 - UX: Users expect 
C:\path\fileto be a local file, not a URL - Consistency: Other OS paths aren't treated as URLs
 
Current vs Proposed
// Now
URL.canParse("C:\\path\\file.node") // true
//Should be
URL.canParse("C:\\path\\file.node") // false
URL.canParse("file:///C:/path/file.node") // trueRelated Issues
- Node.js PR #58578: "node-api: preserve URL filenames without conversion" (node-api: preserve URL filenames without conversion nodejs/node#58578)
 - ada-url PR #957: "fix: reject Windows file paths in can_parse" (fix: reject Windows file paths in can_parse ada-url/ada#957)