However, this doesn't cover DNS name validation for the hostname:

"This specification does not mandate a particular registered name lookup technology and therefore does not restrict the syntax of reg-name beyond what is necessary for interoperability"

It also doesn't constrain the userinfo ("username:password") part described in this vulnerability.

So yeah, it's non-trivial.

  authority   = [ userinfo "@" ] host [ ":" port ]

The RFC reads:

> Use of the format "user:password" in the userinfo field is deprecated.

In the real world, for HTTP use cases, you can't just ignore this because it's deprecated.

Yes. So, a correct implementation can't use this document to destructure it, but that's OK because it doesn't need to do so. It can however easily distinguish the userinfo from the rest of the authority.

Unless, like this code, it simply doesn't bother to try.

> In the real world, for HTTP use cases, you can't just ignore this because it's deprecated.

Then I guess you'll need to write code to further parse the userinfo. Seems pretty easy, but this document doesn't explain how because it's deprecated. No impact on whether you can find the host name in the authority since that's a separate field from userinfo.

Assuming, of course, that you bother to separate userinfo from the domain name in the authority, which Lynx did not.