fix(net-http): parseUrl separates userinfo and rejects junk after an IPv6 bracket (#2072)

Two halves of one post-audit finding.

USERINFO. RFC 3986 3.2 spells the authority `[ userinfo "@" ] host [ ":" port ]`
and this parser had no userinfo rule at all, so http://user@host/p returned the
host "user@host" -- a string that then went to getaddrinfo as a DNS name and
into the Host: header. .NET keeps UserInfo as its own component and its Host
never contains it.

The LAST '@' is the delimiter, per RFC 3986 3.2.1: a '@' is legal inside the
userinfo and the host production admits none. Splitting on the first would make
"b@example.com" the host of http://a@b@example.com/, and a mutation that does
exactly that is caught.

The userinfo is discarded, deliberately, and that is recorded rather than
glossed: ParsedUrl has no userinfo field, this handler has no authentication
path to hand one to, and inventing one is new API. What matters is that it stops
being part of the HOST.

http://user:pass@host/ used to throw for the WRONG reason, and the ticket
noticed: rfind(':') made "pass@host" the port text, so the failure was
accidental and the message said "invalid port". It now succeeds with the host it
always denoted.

IPv6. http://[::1]x/p returned host "::1" and SILENTLY DISCARDED the 'x', so the
URL the caller wrote and the URL the client connected to differed with no
diagnostic. RFC 3986 3.2.2 allows only `":" port` after the closing bracket.

Four mutations. Three caught. The fourth -- removing the empty-host check after
the userinfo split -- was NOT caught, and that is reported rather than papered
over: the check was redundant, because an empty authority already reaches the
empty-host check at the end of the function. The dead code was deleted rather
than defended, and a comment records that a mutation is how that was established.

+5 tests. Gate: 17,256 run, 0 failed, 38 executables -- green. Downstream,
measured: zero HttpClient sites in either consumer.

Record: docs/Migration-HttpClientUrlUserInfo.md.

Author: robertvokac

CLAUDE.md

@@ -0,0 +1,65 @@
+<!-- SPDX-License-Identifier: MIT -->
+<!-- Copyright (c) Robert Vokac and contributors -->
+
+# Migration — `parseUrl` separates userinfo and rejects junk after an IPv6 bracket (ticket #2072)
+
+*2026-08-17.* `HttpClient::parseUrl` had no userinfo rule, so `http://user@host/p` returned the
+host `"user@host"` — a string that then went to `getaddrinfo` as a DNS name and into the `Host:`
+header. And `http://[::1]x/p` returned host `"::1"` with the `x` **silently discarded**.
+
+Landed under `docs/StandingApprovals.md` SA-5. No public signature, layout, vtable or `noexcept`
+change.
+
+---
+
+## 1. What changed
+
+| URL | Was | Is |
+|---|---|---|
+| `http://user@example.com/p` | host `"user@example.com"` | host `"example.com"` |
+| `http://user:pass@example.com/p` | `UriFormatException` — **by accident** (see §3) | host `"example.com"` |
+| `http://user:pass@example.com:8080/p` | `UriFormatException` | host `"example.com"`, port 8080 |
+| `http://a@b@example.com/p` | host `"a@b@example.com"` | host `"example.com"` |
+| `http://user@/p` | host `"user@"` | `UriFormatException` (empty host) |
+| `http://[::1]x/p` | host `"::1"`, `x` **discarded** | `UriFormatException` |
+| `http://[::1]/p`, `http://[::1]:8080/p` | — | **unchanged** |
+| a URL with no `@` in its authority | — | **unchanged** |
+
+## 2. Why
+
+RFC 3986 §3.2 spells the authority `[ userinfo "@" ] host [ ":" port ]`, and §3.2.2 allows only
+`":" port` after an IPv6 literal's closing bracket. .NET keeps `UserInfo` as its own component
+and its `Host` never contains it.
+
+Silently discarding text after the bracket is the more insidious of the two: the URL the caller
+wrote and the URL the client connected to differed, with no diagnostic.
+
+**The last `@` is the delimiter.** RFC 3986 §3.2.1's `userinfo` production admits `@`, and the
+`host` production does not, so the final one splits. Using the first would make `b@example.com`
+the host of `http://a@b@example.com/`.
+
+## 3. `http://user:pass@host/` used to throw for the wrong reason
+
+It did fail before — but because `rfind(':')` made `"pass@example.com"` the **port** text, which
+then failed the port grammar. The failure was accidental, and the message said "invalid port".
+It now succeeds with the host `example.com`, which is what it always denoted.
+
+## 4. The userinfo is discarded, deliberately
+
+`ParsedUrl` has no userinfo field, this handler has no authentication path to hand one to, and
+inventing one is new API. What matters for this ticket is that the userinfo stops being part of
+the **host** — a name that reaches DNS and the `Host:` header.
+
+If you were relying on userinfo reaching the server, it never did: it was going into the host
+name, where it made the lookup fail.
+
+## 5. To migrate
+
+Nothing, unless you pass URLs with credentials in them. Those used to fail (with a misleading
+message) or resolve wrongly; they now parse to the host they name, and the credentials are
+dropped rather than smuggled into a header.
+
+## 6. Downstream, measured
+
+Neither `cna` nor `mobile-eggbert` references `HttpClient` or `System::Net::Http` — **zero sites
+in both**. Neither repository was modified.

docs/Migration-HttpClientUrlUserInfo.md

@@ -149,6 +149,28 @@ HttpClient::ParsedUrl HttpClient::parseUrl(const std::string& url) {
     if (requestTarget.empty()) requestTarget = "/";
     result.path = requestTarget;
 
+    // Ticket #2072 (post-audit defect, deferred verification). RFC 3986 §3.2 spells the
+    // authority `[ userinfo "@" ] host [ ":" port ]`, and this parser had no userinfo rule at
+    // all -- measured, `http://user@host/p` returned host `"user@host"`, which then went to
+    // getaddrinfo as a DNS name and into the `Host:` header. .NET separates it: `Uri.UserInfo`
+    // is its own component and `Uri.Host` never contains it (`Uri.cs:3708-3760`, the
+    // MayHaveUserInfo branch of ParseAuthority).
+    //
+    // The userinfo is DISCARDED rather than surfaced, and that is a deliberate scope decision
+    // recorded rather than glossed: `ParsedUrl` has no userinfo field, this handler has no
+    // authentication path to hand it to, and inventing one is new API. What matters here is
+    // that it stops being part of the HOST -- a name that reaches DNS and the `Host:` header.
+    //
+    // Splitting on the LAST '@' is RFC 3986's rule: a '@' inside the userinfo is legal
+    // (percent-encoded or not, per §3.2.1's `userinfo` production), while the host production
+    // admits none, so the final one is the delimiter.
+    const size_t userInfoEnd = authority.rfind('@');
+    if (userInfoEnd != std::string::npos) authority = authority.substr(userInfoEnd + 1);
+    // No empty-authority check here on purpose: `http://user@/p` leaves an empty authority,
+    // which the empty-host check at the end of this function already rejects. A second check
+    // would be dead code -- a mutation removing it changed nothing, which is how that was
+    // established rather than assumed.
+
     std::string portText;
     bool        hasPort = false;
 
@@ -161,7 +183,14 @@ HttpClient::ParsedUrl HttpClient::parseUrl(const std::string& url) {
         if (closeBracket == std::string::npos)
             throw System::UriFormatException("HttpClient: unterminated IPv6 literal in URL: " + url);
         result.host = authority.substr(1, closeBracket - 1);
-        if (closeBracket + 1 < authority.size() && authority[closeBracket + 1] == ':') {
+        if (closeBracket + 1 < authority.size()) {
+            // #2072: anything after the closing bracket must be a port and nothing else.
+            // Measured before this, `http://[::1]x/p` returned host `"::1"` and SILENTLY
+            // DISCARDED the `x` -- so a URL the caller wrote and a URL the client connected to
+            // differed, with no diagnostic. RFC 3986 §3.2.2 allows only `":" port` there.
+            if (authority[closeBracket + 1] != ':')
+                throw System::UriFormatException(
+                    "HttpClient: unexpected text after the IPv6 literal in URL: " + url);
             portText = authority.substr(closeBracket + 2);
             hasPort  = true;
         }

modules/net-http/src/System/Net/Http/HttpClient.cpp

@@ -2528,3 +2528,76 @@ TEST(HttpParserInteractionTests, AuthorityOnlyQueryReachesTheWireAsTheRequestTar
     EXPECT_EQ(raw.find("key=secret\r\n"), std::string::npos)
         << "and must not appear as the tail of the Host header";
 }
+
+// ---------------------------------------------------------------------------
+// Ticket #2072 (post-audit defect, deferred verification) -- userinfo and the
+// text after an IPv6 bracket.
+// ---------------------------------------------------------------------------
+
+TEST(HttpClientParseUrlUserInfoTests, Fix2072_UserInfoIsNotPartOfTheHost) {
+    // RFC 3986 3.2 spells the authority `[ userinfo "@" ] host [ ":" port ]`, and this parser
+    // had no userinfo rule at all: `http://user@host/p` returned host "user@host", which then
+    // went to getaddrinfo as a DNS NAME and into the `Host:` header. .NET keeps UserInfo as its
+    // own component and its Host never contains it.
+    auto p = HttpClient::parseUrl("http://user@example.com/p");
+    EXPECT_EQ(p.host, "example.com");
+    EXPECT_EQ(p.port, 80);
+    EXPECT_EQ(p.path, "/p");
+
+    // ...with a password, which used to throw for an unrelated reason: rfind(':') made
+    // "pass@example.com" the PORT text, so the failure was accidental rather than a rule.
+    auto withPassword = HttpClient::parseUrl("http://user:pass@example.com/p");
+    EXPECT_EQ(withPassword.host, "example.com");
+    EXPECT_EQ(withPassword.port, 80);
+
+    // ...and with a port after it, which is the combination that proves the split happens in
+    // the right order.
+    auto withPort = HttpClient::parseUrl("http://user:pass@example.com:8080/p");
+    EXPECT_EQ(withPort.host, "example.com");
+    EXPECT_EQ(withPort.port, 8080);
+}
+
+TEST(HttpClientParseUrlUserInfoTests, Fix2072_TheLastAtSignIsTheDelimiter) {
+    // RFC 3986 3.2.1: a '@' is legal INSIDE the userinfo, and the host production admits none,
+    // so the FINAL one is the delimiter. Splitting on the first would make "b@example.com" the
+    // host of "http://a@b@example.com/".
+    auto p = HttpClient::parseUrl("http://a@b@example.com/p");
+    EXPECT_EQ(p.host, "example.com");
+}
+
+TEST(HttpClientParseUrlUserInfoTests, Fix2072_AnEmptyHostAfterUserInfoIsRejected) {
+    EXPECT_THROW((void)HttpClient::parseUrl("http://user@/p"), System::UriFormatException);
+    EXPECT_THROW((void)HttpClient::parseUrl("http://@/p"), System::UriFormatException);
+}
+
+TEST(HttpClientParseUrlUserInfoTests, Fix2072_TextAfterAnIPv6BracketIsRejectedNotDiscarded) {
+    // Measured before this, `http://[::1]x/p` returned host "::1" and SILENTLY DISCARDED the
+    // 'x' -- so the URL the caller wrote and the URL the client connected to differed, with no
+    // diagnostic. RFC 3986 3.2.2 allows only `":" port` after the closing bracket.
+    EXPECT_THROW((void)HttpClient::parseUrl("http://[::1]x/p"), System::UriFormatException);
+    EXPECT_THROW((void)HttpClient::parseUrl("http://[::1]8080/p"), System::UriFormatException);
+
+    // The two legal shapes still work.
+    auto bare = HttpClient::parseUrl("http://[::1]/p");
+    EXPECT_EQ(bare.host, "::1");
+    EXPECT_EQ(bare.port, 80);
+    auto withPort = HttpClient::parseUrl("http://[::1]:8080/p");
+    EXPECT_EQ(withPort.host, "::1");
+    EXPECT_EQ(withPort.port, 8080);
+    // ...including with userinfo in front of the literal.
+    auto withUser = HttpClient::parseUrl("http://user@[::1]:8080/p");
+    EXPECT_EQ(withUser.host, "::1");
+    EXPECT_EQ(withUser.port, 8080);
+}
+
+TEST(HttpClientParseUrlUserInfoTests, Fix2072_AUrlWithoutUserInfoIsUntouched) {
+    // The invariance row: the '@' rule must not disturb anything that has no '@'.
+    auto plain = HttpClient::parseUrl("http://example.com:8080/a/b?q=1");
+    EXPECT_EQ(plain.host, "example.com");
+    EXPECT_EQ(plain.port, 8080);
+    EXPECT_EQ(plain.path, "/a/b?q=1");
+    // An '@' in the PATH is not an authority delimiter, because the authority ended first.
+    auto atInPath = HttpClient::parseUrl("http://example.com/a@b");
+    EXPECT_EQ(atInPath.host, "example.com");
+    EXPECT_EQ(atInPath.path, "/a@b");
+}