URL / Query String Parser implementation

Binding contract

This record describes what an executable surface must bind and validate. It does not claim that a public calculator, package, or production route is deployed.

Record owner

Guth Instruments

Lifecycle

verified-clean

Evidence ID

t5-117

Effect

Computation or source lookup only

Input and validation requirements

• No arithmetic or division-by-zero hazard exists because this instrument performs parsing rather than numerical calculation.
• Malformed percent escapes such as '%ZZ' or a trailing '%' must be rejected or reported explicitly; silently decoding them can corrupt data.
• Query parsing can cause security and interoperability problems if '+' handling, duplicate-key handling, empty values, or parameter ordering are inconsistent.
• Host parsing must define IPv6 bracket handling, internationalized domain names, userinfo, case normalization, and percent-encoding rules.
• A syntactically valid port may still be outside the implementation's supported numeric range or unusable by the network stack.
• The empty honest_label is a concern: the catalog entry should explicitly state that this is an RFC 3986 URI parser with an application-defined query-decoding policy, not imply universal URL validation.

Required corrections

No binding erratum is attached to this unique-name record. Implementers must still preserve the declared units, domain, and failure behavior.

Inspectable interface fixture

The sample below is evidence for interface and validation tests, not a production implementation.

{
  "inputs": {
    "url": "https://example.com:8443/a/b?x=1&name=Alice#section"
  },
  "expected_outputs": {
    "valid": true,
    "scheme": "https",
    "host": "example.com",
    "port": 8443,
    "path": "/a/b",
    "query": "x=1&name=Alice",
    "query_parameters": [
      {
        "key": "x",
        "value": "1"
      },
      {
        "key": "name",
        "value": "Alice"
      }
    ],
    "fragment": "section"
  },
  "working": "1. Identify scheme before ':': 'https'. 2. After '//', authority is 'example.com:8443'; host is 'example.com' and port is 8443. Decimal check: 8×1000 + 4×100 + 4×10 + 3 = 8443. 3. The text before '?' is path '/a/b'. 4. The query is 'x=1&name=Alice'; split at '&' into 'x=1' and 'name=Alice', then split each at '=' to obtain (x, 1) and (name, Alice). 5. The text after '#' is fragment 'section'."
}

Other records

Sources and evidence

These pointers bind the page to evidence. They do not grant authority or collapse verification into deployment.

• VERIFIED_LEDGER.json
• evidence-tranche5/tranche5-results.json