Inconsistency between new URL behavior in Nodejs and browser

[schalkneethling]

• Version:

Node 12.10.0

• Platform:

macOS 64bit

• Subsystem:

When using new URL in Nodejs the result of passing an invalid URL to the constructor is inconsistent with the result returned by the same call inside the browser. For example(where url == https://<script></script>:

try {
  let websiteURL = new URL(url);
} catch (error) {
  console.error(err);
}

running the above in browser devtools return the following expected result:

TypeError: https://<script></script> is not a valid URL.

Running the same in Nodejs, returns the following:

URL {
  href: 'https://<script></script%3E',
  origin: 'https://<script><',
  protocol: 'https:',
  username: '',
  password: '',
  host: '<script><',
  hostname: '<script><',
  port: '',
  pathname: '/script%3E',
  search: '',
  searchParams: URLSearchParams {},
  hash: ''
}

[targos]

From what I've tested, only Firefox throws an error. But Node.js' result is still different from Chrome or Edge:

Test: new URL('https://<script></script>').href

Browser	Output
Firefox 71.0	TypeError: https://<script></script> is not a valid URL.
Edge 44	https://%3cscript%3e%3c/script%3E
Chromium 79	https://%3Cscript%3E%3C/script%3E
Node.js 13.3.0	https://<script></script%3E
whatwg-url module	https://<script></script%3E

/cc @nodejs/url

[domenic]

It'd be good to test Safari as well, as it generally matches the spec. (Which matches whatwg-url and Node.js.)

If no browsers match the spec/Node.js/whatwg-url, then it's worth opening a new issue on https://github.com/whatwg/url/ to get the spec fixed. But if it's a case where the three existing browsers (Edge is dead) all do different results, and one of them matches the spec, then probably the two wrong browsers should change.

[ZYSzys]

Test in Safari(Version 12.1) throws a TypeError:

[domenic]

In that case we have 2/3 browsers throwing an error so the spec should probably be updated to match. Please do open an issue there. After the appropriate spec update goes through then Node.js and whatwg-url can update to follow.

[TimothyGu]

Opened one at whatwg/url#458.

[aduh95]

Fixed by #33328? The inconsistency is still there, but it will go away as the browsers catch up with the updated spec.

Refs: https://bugs.webkit.org/show_bug.cgi?id=211901
Refs: https://bugs.chromium.org/p/chromium/issues/detail?id=660384

[watilde]

I confirmed the original issue has been fixed already by #33328.

Closing as resolved. Thank you.