Consider making URL's context symbol more private, or at least resetting the "flags" member

[domenic]

• Version: v10.8.0
• Platform: Windows 10 64-bit
• Subsystem: url

The (WHATWG) URL object's internal "context" symbol is exposed as an enumerable property on URL instances. This leads to it being considered for comparison by testing frameworks and the like.

For example, see https://repl.it/repls/StaidUnlinedFolder, wherein Jest considers new URL('./foo', 'https://example.com/') and new URL('https://example.com/foo') different because the former has flags: 496, and the latter has flags: 400.

The best solution would probably be using WeakMaps, or V8 private symbols. But you may be able to just make the url[context] property non-enumerable, and maybe that would placate Jest? Or even just reset url[context].flags after you're done parsing, so that even if your internals are exposed, you don't have this weird path-dependence.

/cc @nodejs/url

[devsnek]

sgtm, we already use WeakMap elsewhere in core for this.

[joyeecheung]

Does IDL tests in WPT cover this? This is what I got from #24035 but I have not taken a closer look

[EXPECTED_FAILURE] URL interface: existence and properties of interface object
[EXPECTED_FAILURE] URL interface object length
[EXPECTED_FAILURE] URL interface: legacy window alias
[EXPECTED_FAILURE] URL interface: attribute href
[EXPECTED_FAILURE] URL interface: attribute origin
[EXPECTED_FAILURE] URL interface: attribute protocol
[EXPECTED_FAILURE] URL interface: attribute username
[EXPECTED_FAILURE] URL interface: attribute password
[EXPECTED_FAILURE] URL interface: attribute host
[EXPECTED_FAILURE] URL interface: attribute hostname
[EXPECTED_FAILURE] URL interface: attribute port
[EXPECTED_FAILURE] URL interface: attribute pathname
[EXPECTED_FAILURE] URL interface: attribute search
[EXPECTED_FAILURE] URL interface: attribute searchParams
[EXPECTED_FAILURE] URL interface: attribute hash
[EXPECTED_FAILURE] URLSearchParams interface: existence and properties of interface object

[joyeecheung]

Minimal test case with our assert:

const assert = require('assert');

assert.deepStrictEqual(
  new URL('./foo', 'https://example.com/'),
  new URL('https://example.com/foo')
);

[joyeecheung]

I looked into this a bit further - going hard-private in URL/URLSearchParams seems more complicated than I thought. For one, the symbol properties are displayed in util.inspect through showHidden, that is useful when debugging internals, it's still debuggable with WeakMap but that's less straightforward (though I guess you can also return the data store to the util.inspect.custom to bypass that). Also it requires a bit of refactoring to put them into WeakMap, so I am inclined to just make the context non-enumerable (as it should) first to fix Jest, and follow up with refactoring if anyone is interested in taking up the work..

[Trott]

and follow up with refactoring if anyone is interested in taking up the work..

Adding a help wanted label based on that but feel free to remove it if you or someone else is already doing that.

[joyeecheung]

FTR I tried prototyping with WeakMaps but the performance regression was a bit uh....unacceptable (45
% ish compared to the 15% ish of using Object.defineProperty()). See #24218 (comment) for numbers.

It would still be nice to have a general refactoring in lib/internal/url.js but I guess that can be said about any file under lib/internal?

[Trott]

Fixed in 639f641