#1008·obscura

URL setters: search/hash drop a bare '?'/'#', and port ignores '8080abc' (WHATWG conformance)

Author: mnazaCreated Sep 17, 2026Updated Sep 17, 2026

Summary

Two WHATWG conformance bugs in the URL property setters (url_set_inner, crates/obscura-js/src/ops.rs):

1. url.search = "?" / url.hash = "#" remove the component instead of keeping an empty one.

rust
"search" => { let q = value.strip_prefix('?').unwrap_or(value); u.set_query(if q.is_empty() { None } else { Some(q) }); }

Per the WHATWG URL spec the setter sets the query to null only when the given value is the empty string; a bare "?" sets an empty query, which serializes with a trailing ?. So url.search = "?" should give http://example.com/path?, but obscura drops the ? entirely. Same for url.hash = "#".

2. url.port = "8080abc" is silently ignored.

rust
} else if let Ok(p) = value.parse::<u16>() { let _ = u.set_port(Some(p)); }

parse::<u16>() requires the whole string to be numeric. The WHATWG port-state parser consumes the leading digits and stops at the first non-digit, so url.port = "8080abc" should set the port to 8080; obscura leaves it unchanged.

Fix

  1. In the search/hash arms, set null only when the original value is empty; otherwise set the (possibly empty) stripped value.
  2. In the port arm, parse only the leading ASCII digits.

Affected

  • crates/obscura-js/src/ops.rsurl_set_inner