From f9d797190aa9b986c199fb1fbe1f528aeb9e0bfc Mon Sep 17 00:00:00 2001
From: Valentin Gosu <valentin.gosu@gmail.com>
Date: Wed, 1 Nov 2017 17:58:18 +0100
Subject: [PATCH] Do not allow username,password,port for URLs without a host
 or file URLs

---
 Cargo.toml               |  2 +-
 src/lib.rs               | 11 +++++++----
 src/quirks.rs            |  2 +-
 tests/setters_tests.json | 40 ++++++++++++++++++++++++++++++++++++++++
 tests/unit.rs            | 16 ----------------
 5 files changed, 49 insertions(+), 22 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index be525d77a..b585a8243 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -2,7 +2,7 @@
 
 name = "url"
 # When updating version, also modify html_root_url in the lib.rs
-version = "1.6.0"
+version = "1.6.1"
 authors = ["The rust-url developers"]
 
 description = "URL library for Rust, based on the WHATWG URL Standard"
diff --git a/src/lib.rs b/src/lib.rs
index bc8e92efd..f66956f47 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -104,7 +104,7 @@ assert_eq!(css_url.as_str(), "http://servo.github.io/rust-url/main.css");
 # run().unwrap();
 */
 
-#![doc(html_root_url = "https://docs.rs/url/1.6.0")]
+#![doc(html_root_url = "https://docs.rs/url/1.6.1")]
 
 #[cfg(feature="rustc-serialize")] extern crate rustc_serialize;
 #[macro_use] extern crate matches;
@@ -1427,7 +1427,8 @@ impl Url {
     /// # run().unwrap();
     /// ```
     pub fn set_port(&mut self, mut port: Option<u16>) -> Result<(), ()> {
-        if !self.has_host() || self.scheme() == "file" {
+        // has_host implies !cannot_be_a_base
+        if !self.has_host() || self.host() == Some(Host::Domain("")) || self.scheme() == "file" {
             return Err(())
         }
         if port.is_some() && port == parser::default_port(self.scheme()) {
@@ -1695,7 +1696,8 @@ impl Url {
     /// # run().unwrap();
     /// ```
     pub fn set_password(&mut self, password: Option<&str>) -> Result<(), ()> {
-        if !self.has_host() {
+        // has_host implies !cannot_be_a_base
+        if !self.has_host() || self.host() == Some(Host::Domain("")) || self.scheme() == "file" {
             return Err(())
         }
         if let Some(password) = password {
@@ -1776,7 +1778,8 @@ impl Url {
     /// # run().unwrap();
     /// ```
     pub fn set_username(&mut self, username: &str) -> Result<(), ()> {
-        if !self.has_host() {
+        // has_host implies !cannot_be_a_base
+        if !self.has_host() || self.host() == Some(Host::Domain("")) || self.scheme() == "file" {
             return Err(())
         }
         let username_start = self.scheme_end + 3;
diff --git a/src/quirks.rs b/src/quirks.rs
index 72ad1f065..0c7aaa894 100644
--- a/src/quirks.rs
+++ b/src/quirks.rs
@@ -152,7 +152,7 @@ pub fn set_port(url: &mut Url, new_port: &str) -> Result<(), ()> {
     {
         // has_host implies !cannot_be_a_base
         let scheme = url.scheme();
-        if !url.has_host() || scheme == "file" {
+        if !url.has_host() || url.host() == Some(Host::Domain("")) || scheme == "file" {
             return Err(())
         }
         result = Parser::parse_port(Input::new(new_port), || default_port(scheme), Context::Setter)
diff --git a/tests/setters_tests.json b/tests/setters_tests.json
index 2f44f6298..a45171bf3 100644
--- a/tests/setters_tests.json
+++ b/tests/setters_tests.json
@@ -258,6 +258,22 @@
                 "username": "%c3%89t%C3%A9"
             }
         },
+        {
+            "href": "sc:///",
+            "new_value": "x",
+            "expected": {
+                "href": "sc:///",
+                "username": ""
+            }
+        },
+        {
+            "href": "file://test/",
+            "new_value": "test",
+            "expected": {
+                "href": "file://test/",
+                "username": ""
+            }
+        },
         {
             "href": "javascript://x/",
             "new_value": "wario",
@@ -345,6 +361,22 @@
                 "password": "%c3%89t%C3%A9"
             }
         },
+        {
+            "href": "sc:///",
+            "new_value": "x",
+            "expected": {
+                "href": "sc:///",
+                "password": ""
+            }
+        },
+        {
+            "href": "file://test/",
+            "new_value": "test",
+            "expected": {
+                "href": "file://test/",
+                "password": ""
+            }
+        },
         {
             "href": "javascript://x/",
             "new_value": "bowser",
@@ -1214,6 +1246,14 @@
                 "port": ""
             }
         },
+        {
+            "href": "sc:///",
+            "new_value": "12",
+            "expected": {
+                "href": "sc:///",
+                "port": ""
+            }
+        },
         {
             "href": "sc://x/",
             "new_value": "12",
diff --git a/tests/unit.rs b/tests/unit.rs
index 3f3887b9b..b76a1f80d 100644
--- a/tests/unit.rs
+++ b/tests/unit.rs
@@ -295,22 +295,6 @@ fn host_and_port_display() {
     )
 }
 
-#[test]
-/// https://github.com/servo/rust-url/issues/25
-fn issue_25() {
-    let filename = if cfg!(windows) { r"C:\run\pg.sock" } else { "/run/pg.sock" };
-    let mut url = Url::from_file_path(filename).unwrap();
-    url.check_invariants().unwrap();
-    url.set_scheme("postgres").unwrap();
-    url.check_invariants().unwrap();
-    url.set_host(Some("")).unwrap();
-    url.check_invariants().unwrap();
-    url.set_username("me").unwrap();
-    url.check_invariants().unwrap();
-    let expected = format!("postgres://me@/{}run/pg.sock", if cfg!(windows) { "C:/" } else { "" });
-    assert_eq!(url.as_str(), expected);
-}
-
 #[test]
 /// https://github.com/servo/rust-url/issues/61
 fn issue_61() {