GitoxideLabs/gitoxide gix-url-v0.37.1

gix-url v0.37.1

on GitHub

New Features

• add Url::original_path() Retain the original spelling of every percent-escaped parsed path and expose
  it through Url::original_path(). Fall back to the decoded public path after
  construction or mutation so consumers can use one read-only accessor safely.

Bug Fixes

• match Git URL parsing edge cases.

  Expand the URL baseline with Git-observed authority, port, IPv6, file, and
  percent-encoding forms. Match Git’s scheme-specific delimiters and permissive
  SSH authority behavior, retain escaped paths across serialization, and align
  public docs with the actual parsing and serialization contracts.

• accept scoped IPv6 URL literals.

  Validate RFC 6874 IPv6 addresses and zone identifiers separately, decode scoped
  hosts for SSH invocation, and restore bracketed percent-encoded form during URL
  serialization. Add the scoped form to the Git-generated compatibility baseline.

• keep parsed HTTP paths decoded.

  Retain the encoded HTTP path privately for lossless request serialization while
  exposing the fully decoded public path used by credential consumers. Migrate legacy
  serde values and extend the Git-derived credential baseline with reserved escapes.

• measure URL authorities after the scheme separator.

  Count only bytes after :// when a URL has no path, so the documented 1024-byte
  authority limit accepts exactly 1024 bytes and still rejects 1025.

• validate URL schemes and percent escapes.

  Apply RFC 3986 grammar before decoding: schemes must begin with an ASCII letter
  and every percent sign must introduce two hexadecimal digits. This prevents
  malformed inputs from being accepted and rewritten during serialization.

• preserve percent-encoded URL path delimiters.

  Parse URL components before decoding reserved octets so encoded slashes,
  queries, fragments, and other RFC 3986 delimiters cannot become structure. Keep
  valid escapes intact during HTTP URL serialization, including nested percent
  escapes.

• reject malformed URL authorities.

  Fail closed when GHSA-jrcm-326h-gpp8 redirect authority checks receive syntax
  that RFC 3986 and HTTP clients interpret differently. Reject backslashes,
  non-ASCII reg-names, malformed ports, malformed IPv6 literals, and unbracketed
  IPv6 before host identity is trusted.

• terminate URL authorities at query and fragment delimiters.

  gix-url treated everything before the first slash as the authority, so a
  query or fragment could change the parsed host and make gix-transport retain
  an identity across an actual authority change.

  End the authority at slash, query, or fragment delimiters, and cover both the
  parser result and redirect identity decision. This addresses
  GHSA-jrcm-326h-gpp8 without changing how the remainder is stored in the path.

  Git baseline: git url-parse at da5fa73
  reports the host before either delimiter.

• preserve colons in URL usernames

  Percent-decoded colons in usernames were serialized literally, causing the
  parser to reinterpret the suffix as a password. The regression test shows
  that an HTTP username containing a colon did not survive serialization and
  reparsing.

  Encode colons specifically in the username while retaining the existing
  userinfo encoding for passwords, where colons are data.

  Git baseline: credential.c at a23bace963d508bd96983cc637131392d3face18
  uses the first literal colon as the user/password boundary and percent-decodes
  the resulting fields.

Commit Statistics

• 13 commits contributed to the release over the course of 11 calendar days.
• 11 days passed between releases.
• 10 commits were understood as conventional.
• 1 unique issue was worked on: #2827

Commit Details