URLs
A collection of URLs used to evaluate browser functionality and behaviour.
Tricky URLs
Simple
- Baseline case (example.test) (https)
- Baseline case (example.test) (http)
- Evil.test, for testing paths do not cause the evil.test origin to be hidden
- URL with username and password
- URL with non-default port
- URL with IPv4 literal hostname
- URL with IPv6 literal hostname
- data: URL (copy and paste URL in Chrome, which disallows top-level navigation to data: URLs)
- ftp:// URL
IDNs & Homoglyphs
RTL
Homoglyphs
- URL uses Cyrillic е instead of e
- URL uses Cyrillic ӑ instead of a
- URL uses Cyrillic а in its own label
- URL uses Cyrillic ӑ in its own label
- URL uses number one instead of l
- URL uses “vv” instead of “w”
- URL uses “0” instead of “o”
- URL with a single letter and numbers uses “O” instead of “0”
- URL with a single letter and numbers uses “l” instead of “1”
- URL with a single letter and numbers uses Cyrillic а instead of Latin a
- URL with a single letter and numbers uses Greek α instead of Latin a
- URL with entire domain name “аррӏе” as all Cyrillic characters
Unusual characters
- URL with non-breaking space in path (U+202F)
- URL with non-breaking space in query (U+202F)
- URL with non-breaking space in fragment (U+202F)
- URL with a lock emoji in the domain
- URL with a banana emoji in the domain
- URL with an emoji in its own label
- URL with an emoji in its TLD
- URL with a lock emoji in the path
- URL with a banana emoji in the query
- URL with a banana emoji in the fragment
- URL with spaces in the path
- URL with spaces in the query
- URL with spaces in the fragment
Long
- Extremely long URL to trigger elision, ending in an url that looks similar to example.test
- Extremely long URL to trigger elision, starting with a url that looks similar to example.test
- A very long path ending in example.test
- A very long query ending in example.test
- A very long fragment ending in example.test
- URL with many subdomains