dunglas / go-urlpattern

93%

main: 92%

Pull #14

github

fix: prevent panic on syntax-only pathname/hostname pattern components

Some canonicalization callbacks (e.g. hostname, opaque-pathname) can
collapse a non-empty component like "#" down to an empty string.
generatePatternString assumed adjacent fixed-text parts always carry
a non-empty value and indexed into their rune slice unconditionally,
panicking on inputs like URLPatternInit{Protocol: "A", Hostname: "#*0"}.

Guard both indexing sites, and make canonicalizeHostname fail instead
of silently returning an empty hostname for a non-empty forbidden-host-
code-point input, matching the URL spec and the existing ':' guard.

Found by the new fuzz targets.

9 of 9 new or added lines in 2 files covered. (100.0%)

1509 of 1624 relevant lines covered (92.92%)

1562.7 hits per line