Skip to content

bug: http.get() silently succeeds on invalid URLs instead of returning an error #1555

@SchoolyB

Description

@SchoolyB

Description

When http.get() receives a malformed URL string (no scheme, whitespace in host, etc.), it compiles and runs without returning an error. The Error value is always nil even for obviously invalid URLs because parse_url() accepted any string — it didn't require a scheme prefix.

Repro

import @http

do main() {
    mut resp, err = http.get("not a valid url")
    if err != nil {
        println("got error as expected")
    } otherwise {
        println("no error — this is the bug")
    }
}

Expected: err is non-nil with a descriptive message.

Actual: err is nil. The invalid URL is silently accepted.

Root cause

parse_url() in ez_http.c did not require an http:// or https:// scheme. It treated the entire input as a hostname, which then either failed silently or produced garbage results.

Fix

  • Require http:// or https:// scheme in parse_url()
  • Reject empty hosts and hosts containing whitespace
  • Improved error message: "invalid URL: missing scheme (expected http:// or https://)"
  • Removed invalid fail test E14001_http_invalid_url.ez (E14001 was never emitted by the compiler)

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingstdlibGeneral standard library issues

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions