Description
When http.get() receives a malformed URL string (no scheme, whitespace in host, etc.), it compiles and runs without returning an error. The Error value is always nil even for obviously invalid URLs because parse_url() accepted any string — it didn't require a scheme prefix.
Repro
import @http
do main() {
mut resp, err = http.get("not a valid url")
if err != nil {
println("got error as expected")
} otherwise {
println("no error — this is the bug")
}
}
Expected: err is non-nil with a descriptive message.
Actual: err is nil. The invalid URL is silently accepted.
Root cause
parse_url() in ez_http.c did not require an http:// or https:// scheme. It treated the entire input as a hostname, which then either failed silently or produced garbage results.
Fix
- Require
http:// or https:// scheme in parse_url()
- Reject empty hosts and hosts containing whitespace
- Improved error message: "invalid URL: missing scheme (expected http:// or https://)"
- Removed invalid fail test
E14001_http_invalid_url.ez (E14001 was never emitted by the compiler)
Description
When
http.get()receives a malformed URL string (no scheme, whitespace in host, etc.), it compiles and runs without returning an error. TheErrorvalue is alwaysnileven for obviously invalid URLs becauseparse_url()accepted any string — it didn't require a scheme prefix.Repro
Expected:
erris non-nil with a descriptive message.Actual:
errisnil. The invalid URL is silently accepted.Root cause
parse_url()inez_http.cdid not require anhttp://orhttps://scheme. It treated the entire input as a hostname, which then either failed silently or produced garbage results.Fix
http://orhttps://scheme inparse_url()E14001_http_invalid_url.ez(E14001 was never emitted by the compiler)