URL setters: search/hash drop a bare '?'/'#', and port ignores '8080abc' (WHATWG conformance)
Summary
Two WHATWG conformance bugs in the URL property setters (url_set_inner, crates/obscura-js/src/ops.rs):
1. url.search = "?" / url.hash = "#" remove the component instead of keeping an empty one.
"search" => { let q = value.strip_prefix('?').unwrap_or(value); u.set_query(if q.is_empty() { None } else { Some(q) }); }Per the WHATWG URL spec the setter sets the query to null only when the given value is the empty string; a bare "?" sets an empty query, which serializes with a trailing ?. So url.search = "?" should give http://example.com/path?, but obscura drops the ? entirely. Same for url.hash = "#".
2. url.port = "8080abc" is silently ignored.
} else if let Ok(p) = value.parse::<u16>() { let _ = u.set_port(Some(p)); }parse::<u16>() requires the whole string to be numeric. The WHATWG port-state parser consumes the leading digits and stops at the first non-digit, so url.port = "8080abc" should set the port to 8080; obscura leaves it unchanged.
Fix
- In the
search/hasharms, set null only when the original value is empty; otherwise set the (possibly empty) stripped value. - In the
portarm, parse only the leading ASCII digits.
Affected
crates/obscura-js/src/ops.rs—url_set_inner
Source: h4ckf0r0day/obscura