Skip to content

Avoid iOS 16 URL parsing crash in stringWithUserAndPasswordStripped - #4

Merged
o-nnerb merged 1 commit into
betafrom
fix/ios16-url-percent-encoded-crash
Aug 27, 2026
Merged

Avoid iOS 16 URL parsing crash in stringWithUserAndPasswordStripped#4
o-nnerb merged 1 commit into
betafrom
fix/ios16-url-percent-encoded-crash

Conversation

@o-nnerb

@o-nnerb o-nnerb commented Aug 27, 2026

Copy link
Copy Markdown
Member

Summary

  • URL.user()/password() (the percent-encoded accessors) share internal parsing code with URL.host(percentEncoded:) on iOS 16, and calling them can crash inside host parsing even though host is never touched in stringWithUserAndPasswordStripped.
  • Gate the fast path on iOS 17+ instead of iOS 16+, so iOS 16 falls back to the legacy user/password properties, which don't hit the bug.
  • See https://forums.swift.org/t/70452 for the same crash signature.

Test plan

  • CI build/tests pass
  • Manual verification on an iOS 16 simulator that logging a request with embedded credentials no longer crashes

URL.user()/password() (the percent-encoded accessors) share internal
parsing code with URL.host(percentEncoded:) on iOS 16, and calling
them there can crash inside host parsing even though host is never
touched here. Gate the fast path on iOS 17 instead, so iOS 16 falls
back to the legacy user/password properties, which don't hit the bug.

See https://forums.swift.org/t/70452 for the same crash signature.
@o-nnerb
o-nnerb merged commit 981734f into beta Aug 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant