From 3c41b2d37d8a854678168445f3d2db7e9e4dba87 Mon Sep 17 00:00:00 2001
From: Anne van Kesteren <annevk@annevk.nl>
Date: Fri, 10 Mar 2017 09:56:15 +0100
Subject: [PATCH 1/2] Restrict setting protocol to "file"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

As file URLs cannot have username/password/port we don’t want to allow
changing the scheme of a URL that contains one or more of those
components.

Fixes #259.
---
 url.bs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/url.bs b/url.bs
index ec35294e..8129944e 100644
--- a/url.bs
+++ b/url.bs
@@ -1490,6 +1490,9 @@ string <var>input</var>, optionally with a <a>base URL</a> <var>base</var>, opti
         <p>If <var>state override</var> is given, run these subsubsteps:
 
         <ol>
+         <li><p>If <var>url</var> <a>includes credentials</a> or has a non-null <a for=url>port</a>,
+         and <var>buffer</var> is "<code>file</code>", then return.
+
          <li><p>If <var>url</var>'s <a for=url>scheme</a> is a <a>special scheme</a> and
          <var>buffer</var> is not, then return.
 

From a8ed8d2aefeec1e742490d08844c3d91a87e77fb Mon Sep 17 00:00:00 2001
From: Anne van Kesteren <annevk@annevk.nl>
Date: Fri, 10 Mar 2017 12:12:21 +0100
Subject: [PATCH 2/2] Also account for switching away from "file"

Fixes #270.
---
 url.bs | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/url.bs b/url.bs
index 8129944e..6c566e1d 100644
--- a/url.bs
+++ b/url.bs
@@ -1490,14 +1490,17 @@ string <var>input</var>, optionally with a <a>base URL</a> <var>base</var>, opti
         <p>If <var>state override</var> is given, run these subsubsteps:
 
         <ol>
-         <li><p>If <var>url</var> <a>includes credentials</a> or has a non-null <a for=url>port</a>,
-         and <var>buffer</var> is "<code>file</code>", then return.
-
          <li><p>If <var>url</var>'s <a for=url>scheme</a> is a <a>special scheme</a> and
          <var>buffer</var> is not, then return.
 
          <li><p>If <var>url</var>'s <a for=url>scheme</a> is not a <a>special scheme</a> and
          <var>buffer</var> is, then return.
+
+         <li><p>If <var>url</var> <a>includes credentials</a> or has a non-null <a for=url>port</a>,
+         and <var>buffer</var> is "<code>file</code>", then return.
+
+         <li><p>If <var>url</var>'s <a for=url>scheme</a> is "<code>file</code>" and its
+         <a for=url>host</a> is an <a>empty host</a> or null, then return.
         </ol>
 
        <li><p>Set <var>url</var>'s <a for=url>scheme</a> to <var>buffer</var>.