URI normalization

[lexaknyazev]

From the other discussion:

Speaking of URIs, should we also disallow referencing parent files (e.g. using ../../..)? This was brought to my attention during a security pass.

We should definitely add a note about security concerns (e.g., loading an asset with parent paths from untrusted source). I'm not sure about disallowing such URIs on spec level.

Also related: should we encourage normalization on export (e.g., dir1/./dir2/../tex.png to dir1/tex.png)?

In other words, canonicalized paths. I say yes, especially if caching is happening using this URI.

Possible action items:

• Require / endorse canonicalization
• Discourage / disallow parent dir references

/cc @donmccurdy @bghgary @emackey

[donmccurdy]

Does the term "canonicalization" have a formal definition? Or simply disallowing . and ..? Trying to do a web search and getting the unrelated SEO definition of canonical UR(L)s...

[zellski]

The term should be pretty unambiguous, right? The idea of a canonical form of some expression is pretty well understood. It IS frustrating that someone who's just innocently trying to read the spec, and plugs that phrase into a search bar, will see those SEO-related hits on top... which yeah are mostly a red herring in this context.

[donmccurdy]

Yeah, I think the concept of a canonical URI is unambiguous, but from an implementation perspective I'm hoping we can either point to a definition or enumerate the possible non-canonical edge cases and how to solve them.

1. unwrap ..
2. remove .
3. de-duplicate // path separators
4. alphabetize query and fragment parameters
5. ...?

the node.js path.normalize() function will do 1–3 but not 4, for example.

[lexaknyazev]

The point 4 looks unnecessary to me.

[donmccurdy]

I don't especially think we should require (4) in the spec, but it's certainly necessary if you want caching to work.

Looks like I got (3) wrong. // is a distinct path from / in the URI spec, but functions like Node.js' path.normalize() will de-duplicate it all the same. https://stackoverflow.com/a/38623852/1314762

[andreasplesch]

The term normalization for comparison purposes is explained in this 2005 RFC:

https://tools.ietf.org/html/rfc3986#page-38

Indeed, MS references this RFC in

https://msdn.microsoft.com/en-us/library/dd541267.aspx

in addition to RFC2616 section 3.2.3 ( http://www.rfc-editor.org/rfc/rfc2616.txt ) which only talks about character to character comparisons.

[pjcozzi]

@lexaknyazev do you still plan to add the implementation note linking to IETF?

[lexaknyazev]

Yes, will open a PR soon.

[pjcozzi]

@lexaknyazev any update on the PR? 😄

[pjcozzi]

Yes, will open a PR soon.

@lexaknyazev any update?