Remix.run Logo
LoganDark 3 days ago

Claims that browsers transform "d.csdfdsaf" -> https://d.csdfdsaf, but they don't. They only transform domains with valid TLDs, unless you manually add the URL scheme.

ranger_danger 3 days ago | parent | next [-]

Who or what gets to say what a valid TLD is? Especially when people take advantage of their own local resolvers, they could create anything at any time.

MarsIronPI 3 days ago | parent [-]

IANA maintains a list of TLDs in the root zone[0]. I presume browsers use this list, since it does cover all TLDs in >99% of situations.

[0]: https://data.iana.org/TLD/tlds-alpha-by-domain.txt

ranger_danger 3 days ago | parent [-]

Yes but local/corporate DNS servers can use any TLD they want...

MarsIronPI 2 days ago | parent [-]

Right, but browsers don't automatically recognize those, as far as I know. If you want to visit a site with a custom TLD I believe you have to prefix it with the protocol.

krasun 3 days ago | parent | prev [-]

It is a good one to fix. Thank you!

myfonj 3 days ago | parent [-]

The "guesswork" done by browsers is actually pretty nuanced and not standardised in a slightest way. Some defaults are pretty common, and could be maybe considered de-facto standard, but I wouldn't want to draw the line where "most" browsers agree or should agree.

Personally, I have my browser set up to "guess" as little as possible, never do the search from the URL bar unless explicitly told to do so using a dedicated search keyword (plus I still keep separated auto-collapsing search bar). I have disabled all guessing for TLDs, auto prepending www. In short, when I enter "whatever" into my URL bar, my browser tries to load to "http://whatever/", what could be my local domain and I could get an answer -- it is is a valid URL after all. In a related note, I strongly doubt that any browser does the web search for "localhost".

The rabbit hole could naturally go even deeper: for example most browser still interpret top-level dataURIs. It is not that long browsers interpreted top-level `javascript:` URIs entered into URL bar, now surviving in bookmarklets but taken from all users for the sake of a pitiful "self-XSS prevention".

So I would be really careful telling what happens -- or, god forbid, should happen -- when someone types something into their URL bar: "whatever" could be a search keyword with set meaning: - it could be bound to http URL (bookmark), - the bookmark URL could have a `%s` or `%S` and then it would do the substitution, - it could be a `javascript:…` bookmark ("bookmarklet"/"favelet"; yes, most browser still let you do that, yet alas, mostly fail to treat CSP in a way it would remain operational). - It could be a local domain.

The fact that, statistically, "most" browsers will do a web search using some default engine is probably correct but oversimplifying claim that glosses over quite a lot of interesting possibilities.