Hacker News Reader

Comment by meindnoch | Hacker News Reader

>according to that regex this is a valid url >__..__..%%%zz..

Correctly. It is a valid relative URI, whose path is "__..__..%%%zz..".

% characters must be escaped in URIs at the very least, and _ is not valid in domains

also this one is valid too for the regex

    %_%://%_%.%_%/%_%?%_%#%_%

courtesy of chatgpt there is also this abomination

    ht tp://[\x00::gg]\t/foo\nbar/%/%QZ/%F?q=<\"|{}>##