Thanks for the effort you put into this!

In addition to the performance gains, this will help prevent future
security bugs. You know this, of course (and hinted at it with the mention
of more predictable behaviour), but I want everyone else to appreciate that
benefit of your work. String URLs are a temptation to evil (*ad hoc*
parsing): any difference in how one section of code interprets a URL
compared to another could easily be a security bug. URLs may not be as bad
as names
<https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-believe-about-names/>,
but they do have edge cases that aren't obvious from the way most web URLs
look. Always use the common parsing routines and operate on nsIURIs (or
Principals) rather than strings.

-Dan Veditz

-- 
You received this message because you are subscribed to the Google Groups 
"[email protected]" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To view this discussion on the web visit 
https://groups.google.com/a/mozilla.org/d/msgid/dev-platform/CADYDTCDG9Z3bABCDo5LUxOVKDz6S36-5xDouWfsFLRVxRoQVsQ%40mail.gmail.com.

Reply via email to