net/url: `Parse` and `ParseRequestURI` permissively accepts trailing colon after port

[viktigpetterr]

Go version

go version go1.25.0 darwin/arm6

Output of go env in your module/workspace:

AR='ar'
CC='cc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='c++'
GCCGO='gccgo'
GO111MODULE='on'
GOARCH='arm64'
GOARM64='v8.0'
GOAUTH='netrc'
GOBIN='/Users/viktigpetterr/go/bin'
GOCACHE='/Users/viktigpetterr/Library/Caches/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/Users/viktigpetterr/Library/Application Support/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -arch arm64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -ffile-prefix-map=/var/folders/78/__zfw80925vgr6jyj1rw514m0000gn/T/go-build3038274493=/tmp/go-build -gno-record-gcc-switches -fno-common'
GOHOSTARCH='arm64'
GOHOSTOS='darwin'
GOINSECURE=''
GOMOD='/dev/null'
GOMODCACHE='/Users/viktigpetterr/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='darwin'
GOPATH='/Users/viktigpetterr/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/opt/homebrew/opt/go/libexec'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/Users/viktigpetterr/Library/Application Support/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/opt/homebrew/opt/go/libexec/pkg/tool/darwin_arm64'
GOVCS=''
GOVERSION='go1.25.0'
GOWORK=''
PKG_CONFIG='pkg-config'

What did you do?

I used url.Parse and url.ParseRequestURI to parse an URL with a trailing colon http://127.0.0.1:8080:.

https://go.dev/play/p/7KST83BAnsD

What did you see happen?

The URL was successfully parsed by both functions where I would expect them to return errors.

What did you expect to see?

I expected url.Parse and url.ParseRequestURI to return an error.

The docs state that net/url generally follows RFC 3986. To me, the trailing colon looks like a violation to the port specification

[gabyhelp]

Related Issues

• net/url: first path segment in URL cannot contain colon. #19297 (closed)
• url parse return error for valid rawurl #36216 (closed)
• net/url: parsing URLs with port > 65536 should fail #69443 (closed)
• net/url: url.Parse returns an error while parsing 192.168.210.111:8080 #30362 (closed)
• affected/package: url.Parse #51358 (closed)
• net/url: Parse returns URL whose Host contains colon #25511 (closed)
• net/url: Parse can't parse url like 10.88.237.69:4222 #21415 (closed)
• net/url: parse url error with leading space in url #24246 (closed)
• net/url: URL allows malformed query round trip #22907

Related Code Changes

• net/url: fixed host :port parsing

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[jadolg]

This seems to be happening because of how the port is being extracted.
Here it will take anything after the last :

go/src/net/url/url.go

Line 663 in 7bba745

} else if i := strings.LastIndex(host, ":"); i != -1 {

and validate it using

go/src/net/url/url.go

Line 797 in 7bba745

func validOptionalPort(port string) bool {

which will accept the port as "optional" so it can be empty.
In both cases the URL is parsed but the port is not parsed correctly.

Now if I'm reading the RFC correctly, we should not allow the : if there's no port present so the validation function should not allow the "optional" part

URI producers and normalizers should omit the port component and its ":" delimiter if port is empty or if its value would be the same as that of the scheme's default.

[jadolg]

It seems this was introduced on purpose:

• net/url: inconsistent Parse error with missing port #12200
• a456e35
  I lack the context to know why the decision was made to accept non RFC compliant URLs.

[prattmic]

cc @rsc @neild

[neild]

#12200 is about whether we permit an empty port. (We should permit an empty port--RFC 3986 says that an empty port should be omitted, not must.) This issue is about a colon after the port, as in http://127.0.0.1:8080:.

I agree that we shouldn't permit a colon after the port.

[gopherbot]

Change https://go.dev/cl/700656 mentions this issue: net/url: don't permit a colon after the port