Can't agree more that URL syntax is overcomplicated. Even existing URL parsing libraries behave inconsistently and lead to security vulnerabilities [0].
[0] https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-Ne...
[0] https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-Ne...
Care to elaborate?
https://www.youtube.com/watch?v=D1S-G8rJrEk
He also has a blog post about it:
http://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilitie...
The premise is that URL parsing is complex and libraries get it wrong. This problem is pervasive and leads to server side request forgery vulnerabilities, which Orange was able to escalate to remote code execution on Github.