]> git.ipfire.org Git - thirdparty/man-pages.git/blob - man7/uri.7
2df7f0d3b5a324586fef0ee766c91e2857d493a9
[thirdparty/man-pages.git] / man7 / uri.7
1 '\"
2 .\" (C) Copyright 1999-2000 David A. Wheeler (dwheeler@dwheeler.com)
3 .\"
4 .\" Permission is granted to make and distribute verbatim copies of this
5 .\" manual provided the copyright notice and this permission notice are
6 .\" preserved on all copies.
7 .\"
8 .\" Permission is granted to copy and distribute modified versions of this
9 .\" manual under the conditions for verbatim copying, provided that the
10 .\" entire resulting derived work is distributed under the terms of a
11 .\" permission notice identical to this one.
12 .\"
13 .\" Since the Linux kernel and libraries are constantly changing, this
14 .\" manual page may be incorrect or out-of-date. The author(s) assume no
15 .\" responsibility for errors or omissions, or for damages resulting from
16 .\" the use of the information contained herein. The author(s) may not
17 .\" have taken the same level of care in the production of this manual,
18 .\" which is licensed free of charge, as they might when working
19 .\" professionally.
20 .\"
21 .\" Formatted or processed versions of this manual, if unaccompanied by
22 .\" the source, must acknowledge the copyright and authors of this work.
23 .\"
24 .\" Fragments of this document are directly derived from IETF standards.
25 .\" For those fragments which are directly derived from such standards,
26 .\" the following notice applies, which is the standard copyright and
27 .\" rights announcement of The Internet Society:
28 .\"
29 .\" Copyright (C) The Internet Society (1998). All Rights Reserved.
30 .\" This document and translations of it may be copied and furnished to
31 .\" others, and derivative works that comment on or otherwise explain it
32 .\" or assist in its implementation may be prepared, copied, published
33 .\" and distributed, in whole or in part, without restriction of any
34 .\" kind, provided that the above copyright notice and this paragraph are
35 .\" included on all such copies and derivative works. However, this
36 .\" document itself may not be modified in any way, such as by removing
37 .\" the copyright notice or references to the Internet Society or other
38 .\" Internet organizations, except as needed for the purpose of
39 .\" developing Internet standards in which case the procedures for
40 .\" copyrights defined in the Internet Standards process must be
41 .\" followed, or as required to translate it into languages other than English.
42 .\"
43 .\" Modified Fri Jul 25 23:00:00 1999 by David A. Wheeler (dwheeler@dwheeler.com)
44 .\" Modified Fri Aug 21 23:00:00 1999 by David A. Wheeler (dwheeler@dwheeler.com)
45 .\" Modified Tue Mar 14 2000 by David A. Wheeler (dwheeler@dwheeler.com)
46 .\"
47 .TH URI 7 2000-03-14 "Linux" "Linux Programmer's Manual"
48 .SH NAME
49 uri, url, urn \- uniform resource identifier (URI), including a URL or URN
50 .SH SYNOPSIS
51 .nf
52 .HP 0.2i
53 URI = [ absoluteURI | relativeURI ] [ "#" fragment ]
54 .HP
55 absoluteURI = scheme ":" ( hierarchical_part | opaque_part )
56 .HP
57 relativeURI = ( net_path | absolute_path | relative_path ) [ "?" query ]
58 .sp
59 .HP
60 scheme = "http" | "ftp" | "gopher" | "mailto" | "news" | "telnet" | "file" | "man" | "info" | "whatis" | "ldap" | "wais" | \&...
61 .HP
62 hierarchical_part = ( net_path | absolute_path ) [ "?" query ]
63 .sp
64 .HP
65 net_path = "//" authority [ absolute_path ]
66 .HP
67 absolute_path = "/" path_segments
68 .HP
69 relative_path = relative_segment [ absolute_path ]
70 .fi
71 .SH DESCRIPTION
72 .PP
73 A Uniform Resource Identifier (URI) is a short string of characters
74 identifying an abstract or physical resource (for example, a web page).
75 A Uniform Resource Locator (URL) is a URI
76 that identifies a resource through its primary access
77 mechanism (e.g., its network "location"), rather than
78 by name or some other attribute of that resource.
79 A Uniform Resource Name (URN) is a URI
80 that must remain globally unique and persistent even when
81 the resource ceases to exist or becomes unavailable.
82 .PP
83 URIs are the standard way to name hypertext link destinations
84 for tools such as web browsers.
85 The string "http://www.kernelnotes.org" is a URL (and thus it's a URI).
86 Many people use the term URL loosely as a synonym for URI
87 (though technically URLs are a subset of URIs).
88 .PP
89 URIs can be absolute or relative.
90 An absolute identifier refers to a resource independent of
91 context, while a relative
92 identifier refers to a resource by describing the difference
93 from the current context.
94 Within a relative path reference, the complete path segments "." and
95 ".." have special meanings: "the current hierarchy level" and "the
96 level above this hierarchy level", respectively, just like they do in
97 Unix-like systems.
98 A path segment which contains a colon
99 character can't be used as the first segment of a relative URI path
100 (e.g., "this:that"), because it would be mistaken for a scheme name;
101 precede such segments with ./ (e.g., "./this:that").
102 Note that descendants of MS-DOS (e.g., Microsoft Windows) replace
103 devicename colons with the vertical bar ("|") in URIs, so "C:" becomes "C|".
104 .PP
105 A fragment identifier, if included, refers to a particular named portion
106 (fragment) of a resource; text after a '#' identifies the fragment.
107 A URI beginning with '#' refers to that fragment in the current resource.
108 .SH USAGE
109 There are many different URI schemes, each with specific
110 additional rules and meanings, but they are intentionally made to be
111 as similar as possible.
112 For example, many URL schemes
113 permit the authority to be the following format, called here an
114 .I ip_server
115 (square brackets show what's optional):
116 .HP
117 .IR "ip_server = " [ user " [ : " password " ] @ ] " host " [ : " port ]
118 .PP
119 This format allows you to optionally insert a user name,
120 a user plus password, and/or a port number.
121 The
122 .I host
123 is the name of the host computer, either its name as determined by DNS
124 or an IP address (numbers separated by periods).
125 Thus the URI
126 <http://fred:fredpassword@xyz.com:8080/>
127 logs into a web server on host xyz.com
128 as fred (using fredpassword) using port 8080.
129 Avoid including a password in a URI if possible because of the many
130 security risks of having a password written down.
131 If the URL supplies a user name but no password, and the remote
132 server requests a password, the program interpreting the URL
133 should request one from the user.
134 .PP
135 Here are some of the most common schemes in use on Unix-like systems
136 that are understood by many tools.
137 Note that many tools using URIs also have internal schemes or specialized
138 schemes; see those tools' documentation for information on those schemes.
139 .SS "http \- Web (HTTP) server"
140 .RI http:// ip_server / path
141 .br
142 .RI http:// ip_server / path ? query
143 .PP
144 This is a URL accessing a web (HTTP) server.
145 The default port is 80.
146 If the path refers to a directory, the web server will choose what
147 to return; usually if there is a file named "index.html" or "index.htm"
148 its content is returned, otherwise, a list of the files in the current
149 directory (with appropriate links) is generated and returned.
150 An example is <http://lwn.net>.
151 .PP
152 A query can be given in the archaic "isindex" format, consisting of a
153 word or phrase and not including an equal sign (=).
154 A query can also be in the longer "GET" format, which has one or more
155 query entries of the form
156 .IR key = value
157 separated by the ampersand character (&).
158 Note that
159 .I key
160 can be repeated more than once, though it's up to the web server
161 and its application programs to determine if there's any meaning to that.
162 There is an unfortunate interaction with HTML/XML/SGML and
163 the GET query format; when such URIs with more than one key
164 are embedded in SGML/XML documents (including HTML), the ampersand
165 (&) has to be rewritten as &amp;.
166 Note that not all queries use this format; larger forms
167 may be too long to store as a URI, so they use a different
168 interaction mechanism (called POST) which does not include the data in the URI.
169 See the Common Gateway Interface specification at
170 <http://www.w3.org/CGI> for more information.
171 .SS "ftp \- File Transfer Protocol (FTP)"
172 .RI ftp:// ip_server / path
173 .PP
174 This is a URL accessing a file through the file transfer protocol (FTP).
175 The default port (for control) is 21.
176 If no username is included, the user name "anonymous" is supplied, and
177 in that case many clients provide as the password the requestor's
178 Internet email address.
179 An example is
180 <ftp://ftp.is.co.za/rfc/rfc1808.txt>.
181 .SS "gopher \- Gopher server"
182 .RI gopher:// ip_server / "gophertype selector"
183 .br
184 .RI gopher:// ip_server / "gophertype selector" %09 search
185 .br
186 .RI gopher:// ip_server / "gophertype selector" %09 search %09 gopher+_string
187 .br
188 .PP
189 The default gopher port is 70.
190 .I gophertype
191 is a single-character field to denote the
192 Gopher type of the resource to
193 which the URL refers.
194 The entire path may also be empty, in
195 which case the delimiting "/" is also optional and the gophertype
196 defaults to "1".
197 .PP
198 .I selector
199 is the Gopher selector string. In the Gopher protocol,
200 Gopher selector strings are a sequence of octets which may contain
201 any octets except 09 hexadecimal (US-ASCII HT or tab), 0A hexadecimal
202 (US-ASCII character LF), and 0D (US-ASCII character CR).
203 .SS "mailto \- Email address"
204 .RI mailto: email-address
205 .PP
206 This is an email address, usually of the form
207 .IR name @ hostname .
208 See
209 .BR mailaddr (7)
210 for more information on the correct format of an email address.
211 Note that any % character must be rewritten as %25.
212 An example is <mailto:dwheeler@dwheeler.com>.
213 .SS "news \- Newsgroup or News message"
214 .RI news: newsgroup-name
215 .br
216 .RI news: message-id
217 .PP
218 A
219 .I newsgroup-name
220 is a period-delimited hierarchical name, such as
221 "comp.infosystems.www.misc".
222 If <newsgroup-name> is "*" (as in <news:*>), it is used to refer
223 to "all available news groups".
224 An example is <news:comp.lang.ada>.
225 .PP
226 A
227 .I message-id
228 corresponds to the Message-ID of
229 .UR http://www.ietf.org/rfc/rfc1036.txt
230 IETF RFC 1036,
231 .UE
232 without the enclosing "<"
233 and ">"; it takes the form
234 .IR unique @ full_domain_name .
235 A message identifier may be distinguished from a news group name by the
236 presence of the "@" character.
237 .SS "telnet \- Telnet login"
238 .RI telnet:// ip_server /
239 .PP
240 The Telnet URL scheme is used to designate interactive text services that
241 may be accessed by the Telnet protocol. The final "/" character may be omitted.
242 The default port is 23.
243 An example is <telnet://melvyl.ucop.edu/>.
244 .SS "file \- Normal file"
245 .RI file:// ip_server / path_segments
246 .br
247 .RI file: path_segments
248 .PP
249 This represents a file or directory accessible locally.
250 As a special case,
251 .I host
252 can be the string "localhost" or the empty
253 string; this is interpreted as `the machine from which the URL is
254 being interpreted'.
255 If the path is to a directory, the viewer should display the
256 directory's contents with links to each containee;
257 not all viewers currently do this.
258 KDE supports generated files through the URL <file:/cgi-bin>.
259 If the given file isn't found, browser writers may want to try to expand
260 the filename via filename globbing
261 (see
262 .BR glob (7)
263 and
264 .BR glob (3)).
265 .PP
266 The second format (e.g., <file:/etc/passwd>)
267 is a correct format for referring to
268 a local file. However, older standards did not permit this format,
269 and some programs don't recognize this as a URI.
270 A more portable syntax is to use an empty string as the server name, e.g.,
271 <file:///etc/passwd>; this form does the same thing
272 and is easily recognized by pattern matchers and older programs as a URI.
273 Note that if you really mean to say "start from the current location," don't
274 specify the scheme at all; use a relative address like <../test.txt>,
275 which has the side-effect of being scheme-independent.
276 An example of this scheme is <file:///etc/passwd>.
277 .SS "man \- Man page documentation"
278 .RI man: command-name
279 .br
280 .RI man: command-name ( section )
281 .PP
282 This refers to local online manual (man) reference pages.
283 The command name can optionally be followed by a parenthesis and section number;
284 see
285 .BR man (7)
286 for more information on the meaning of the section numbers.
287 This URI scheme is unique to Unix-like systems (such as Linux)
288 and is not currently registered by the IETF.
289 An example is <man:ls(1)>.
290 .SS "info \- Info page documentation"
291 .RI info: virtual-filename
292 .br
293 .RI info: virtual-filename # nodename
294 .br
295 .RI info:( virtual-filename )
296 .br
297 .RI info:( virtual-filename ) nodename
298 .PP
299 This scheme refers to online info reference pages (generated from
300 texinfo files), a documentation format used by programs such as the GNU tools.
301 This URI scheme is unique to Unix-like systems (such as Linux)
302 and is not currently registered by the IETF.
303 As of this writing, GNOME and KDE differ in their URI syntax
304 and do not accept the other's syntax.
305 The first two formats are the GNOME format; in nodenames all spaces
306 are written as underscores.
307 The second two formats are the KDE format;
308 spaces in nodenames must be written as spaces, even though this
309 is forbidden by the URI standards.
310 It's hoped that in the future most tools will understand all of these
311 formats and will always accept underscores for spaces in nodenames.
312 In both GNOME and KDE, if the form without the nodename is used the
313 nodename is assumed to be "Top".
314 Examples of the GNOME format are <info:gcc> and <info:gcc#G++_and_GCC>.
315 Examples of the KDE format are <info:(gcc)> and <info:(gcc)G++ and GCC>.
316 .SS "whatis \- Documentation search"
317 .RI whatis: string
318 .PP
319 This scheme searches the database of short (one-line) descriptions of commands
320 and returns a list of descriptions containing that string.
321 Only complete word matches are returned.
322 See
323 .BR whatis (1).
324 This URI scheme is unique to Unix-like systems (such as Linux)
325 and is not currently registered by the IETF.
326 .SS "ghelp \- GNOME help documentation"
327 .RI ghelp: name-of-application
328 .PP
329 This loads GNOME help for the given application.
330 Note that not much documentation currently exists in this format.
331 .SS "ldap \- Lightweight Directory Access Protocol"
332 .RI ldap:// hostport
333 .br
334 .RI ldap:// hostport /
335 .br
336 .RI ldap:// hostport / dn
337 .br
338 .RI ldap:// hostport / dn ? attributes
339 .br
340 .RI ldap:// hostport / dn ? attributes ? scope
341 .br
342 .RI ldap:// hostport / dn ? attributes ? scope ? filter
343 .br
344 .RI ldap:// hostport / dn ? attributes ? scope ? filter ? extensions
345 .PP
346 This scheme supports queries to the
347 Lightweight Directory Access Protocol (LDAP), a protocol for querying
348 a set of servers for hierarchically-organized information
349 (such as people and computing resources).
350 More information on the LDAP URL scheme is available in
351 .UR http://www.ietf.org/rfc/rfc2255.txt
352 RFC 2255.
353 .UE
354 The components of this URL are:
355 .IP hostport 12
356 the LDAP server to query, written as a hostname optionally followed by
357 a colon and the port number.
358 The default LDAP port is TCP port 389.
359 If empty, the client determines which the LDAP server to use.
360 .IP dn
361 the LDAP Distinguished Name, which identifies
362 the base object of the LDAP search (see
363 .UR http://www.ietf.org/rfc/rfc2253.txt
364 RFC 2253
365 .UE
366 section 3).
367 .IP attributes
368 a comma-separated list of attributes to be returned;
369 see RFC 2251 section 4.1.5. If omitted, all attributes should be returned.
370 .IP scope
371 specifies the scope of the search, which can be one of
372 "base" (for a base object search), "one" (for a one-level search),
373 or "sub" (for a subtree search). If scope is omitted, "base" is assumed.
374 .IP filter
375 specifies the search filter (subset of entries
376 to return). If omitted, all entries should be returned.
377 See
378 .UR http://www.ietf.org/rfc/rfc2254.txt
379 RFC 2254
380 .UE
381 section 4.
382 .IP extensions
383 a comma-separated list of type=value
384 pairs, where the =value portion may be omitted for options not
385 requiring it. An extension prefixed with a '!' is critical
386 (must be supported to be valid), otherwise it's non-critical (optional).
387 .PP
388 LDAP queries are easiest to explain by example.
389 Here's a query that asks ldap.itd.umich.edu for information about
390 the University of Michigan in the U.S.:
391 .RS
392 ldap://ldap.itd.umich.edu/o=University%20of%20Michigan,c=US
393 .RE
394 .PP
395 To just get its postal address attribute, request:
396 .RS
397 ldap://ldap.itd.umich.edu/o=University%20of%20Michigan,c=US?postalAddress
398 .RE
399 .PP
400 To ask a host.com at port 6666 for information about the person
401 with common name (cn) "Babs Jensen" at University of Michigan, request:
402 .RS
403 ldap://host.com:6666/o=University%20of%20Michigan,c=US??sub?(cn=Babs%20Jensen)
404 .RE
405 .SS "wais \- Wide Area Information Servers"
406 .RI wais:// hostport / database
407 .br
408 .RI wais:// hostport / database ? search
409 .br
410 .RI wais:// hostport / database / wtype / wpath
411 .PP
412 This scheme designates a WAIS database, search, or document
413 (see
414 .UR http://www.ietf.org/rfc/rfc1625.txt
415 IETF RFC 1625
416 .UE
417 for more information on WAIS).
418 Hostport is the hostname, optionally followed by a colon and port number
419 (the default port number is 210).
420 .PP
421 The first form designates a WAIS database for searching.
422 The second form designates a particular search of the WAIS database
423 .IR database .
424 The third form designates a particular document within a WAIS
425 database to be retrieved.
426 .I wtype
427 is the WAIS designation of the type of the object and
428 .I wpath
429 is the WAIS document-id.
430 .SS "other schemes"
431 There are many other URI schemes.
432 Most tools that accept URIs support a set of internal URIs
433 (e.g., Mozilla has the about: scheme for internal information,
434 and the GNOME help browser has the toc: scheme for various starting
435 locations).
436 There are many schemes that have been defined but are not as widely
437 used at the current time
438 (e.g., prospero).
439 The nntp: scheme is deprecated in favor of the news: scheme.
440 URNs are to be supported by the urn: scheme, with a hierarchical name space
441 (e.g., urn:ietf:... would identify IETF documents); at this time
442 URNs are not widely implemented.
443 Not all tools support all schemes.
444 .SH "CHARACTER ENCODING"
445 .PP
446 URIs use a limited number of characters so that they can be
447 typed in and used in a variety of situations.
448 .PP
449 The following characters are reserved, that is, they may appear in a
450 URI but their use is limited to their reserved purpose
451 (conflicting data must be escaped before forming the URI):
452 .IP
453 ; / ? : @ & = + $ ,
454 .PP
455 Unreserved characters may be included in a URI.
456 Unreserved characters
457 include include upper and lower case English letters,
458 decimal digits, and the following
459 limited set of punctuation marks and symbols:
460 .IP
461 \- _ . ! ~ * ' ( )
462 .PP
463 All other characters must be escaped.
464 An escaped octet is encoded as a character triplet, consisting of the
465 percent character "%" followed by the two hexadecimal digits
466 representing the octet code (you can use upper or lower case letters
467 for the hexadecimal digits). For example, a blank space must be escaped
468 as "%20", a tab character as "%09", and the "&" as "%26".
469 Because the percent "%" character always has the reserved purpose of
470 being the escape indicator, it must be escaped as "%25".
471 It is common practice to escape space characters as the plus symbol (+)
472 in query text; this practice isn't uniformly defined
473 in the relevant RFCs (which recommend %20 instead) but any tool accepting
474 URIs with query text should be prepared for them.
475 A URI is always shown in its "escaped" form.
476 .PP
477 Unreserved characters can be escaped without changing the semantics
478 of the URI, but this should not be done unless the URI is being used
479 in a context that does not allow the unescaped character to appear.
480 For example, "%7e" is sometimes used instead of "~" in an http URL
481 path, but the two are equivalent for an http URL.
482 .PP
483 For URIs which must handle characters outside the US ASCII character set,
484 the HTML 4.01 specification (section B.2) and
485 IETF RFC 2718 (section 2.2.5) recommend the following approach:
486 .IP 1. 4
487 translate the character sequences into UTF-8 (IETF RFC 2279) \(em see
488 .BR utf-8 (7)
489 \(em and then
490 .IP 2.
491 use the URI escaping mechanism, that is,
492 use the %HH encoding for unsafe octets.
493 .SH "WRITING A URI"
494 When written, URIs should be placed inside doublequotes
495 (e.g., "http://www.kernelnotes.org"),
496 enclosed in angle brackets (e.g., <http://lwn.net>),
497 or placed on a line by themselves.
498 A warning for those who use double-quotes:
499 .B never
500 move extraneous punctuation (such as the period ending a sentence or the
501 comma in a list)
502 inside a URI, since this will change the value of the URI.
503 Instead, use angle brackets instead, or
504 switch to a quoting system that never includes extraneous characters
505 inside quotation marks.
506 This latter system, called the 'new' or 'logical' quoting system by
507 "Hart's Rules" and the "Oxford Dictionary for Writers and Editors",
508 is preferred practice in Great Britain and hackers worldwide
509 (see the
510 .UR http://www.fwi.uva.nl/~mes/jargon/h/HackerWritingStyle.html
511 Jargon File's section on Hacker Writing Style
512 .UE
513 for more information).
514 Older documents suggested inserting the prefix "URL:"
515 just before the URI, but this form has never caught on.
516 .PP
517 The URI syntax was designed to be unambiguous.
518 However, as URIs have become commonplace, traditional media
519 (television, radio, newspapers, billboards, etc.) have increasingly
520 used abbreviated URI references consisting of
521 only the authority and path portions of the identified resource
522 (e.g., <www.w3.org/Addressing>).
523 Such references are primarily
524 intended for human interpretation rather than machine, with the
525 assumption that context-based heuristics are sufficient to complete
526 the URI (e.g., hostnames beginning with "www" are likely to have
527 a URI prefix of "http://" and hostnames beginning with "ftp" likely
528 to have a prefix of "ftp://").
529 Many client implementations heuristically resolve these references.
530 Such heuristics may
531 change over time, particularly when new schemes are introduced.
532 Since an abbreviated URI has the same syntax as a relative URL path,
533 abbreviated URI references cannot be used where relative URIs are
534 permitted, and can only be used when there is no defined base
535 (such as in dialog boxes).
536 Don't use abbreviated URIs as hypertext links inside a document;
537 use the standard format as described here.
538 .SH NOTES
539 Any tool accepting URIs (e.g., a web browser) on a Linux system should
540 be able to handle (directly or indirectly) all of the schemes described here,
541 including the man: and info: schemes.
542 Handling them by invoking some other program is fine and in fact encouraged.
543 .PP
544 Technically the fragment isn't part of the URI.
545 .PP
546 For information on how to embed URIs (including URLs) in a data format,
547 see documentation on that format.
548 HTML uses the format <A HREF="\fIuri\fP">
549 .I text
550 </A>.
551 Texinfo files use the format @uref{\fIuri\fP}.
552 Man and mdoc have the recently-added UR macro, or just include the
553 URI in the text (viewers should be able to detect :// as part of a URI).
554 .PP
555 The GNOME and KDE desktop environments currently vary in the URIs they accept,
556 in particular in their respective help browsers.
557 To list man pages, GNOME uses <toc:man> while KDE uses <man:(index)>, and
558 to list info pages, GNOME uses <toc:info> while KDE uses <info:(dir)>
559 (the author of this man page prefers the KDE approach here, though a more
560 regular format would be even better).
561 In general, KDE uses <file:/cgi-bin/> as a prefix to a set of generated
562 files.
563 KDE prefers documentation in HTML, accessed via the
564 <file:/cgi-bin/helpindex>.
565 GNOME prefers the ghelp scheme to store and find documentation.
566 Neither browser handles file: references to directories at the time
567 of this writing, making it difficult to refer to an entire directory with
568 a browsable URI.
569 As noted above, these environments differ in how they handle the info: scheme,
570 probably the most important variation.
571 It is expected that GNOME and KDE
572 will converge to common URI formats, and a future
573 version of this man page will describe the converged result.
574 Efforts to aid this convergence are encouraged.
575 .SH SECURITY
576 .PP
577 A URI does not in itself pose a security threat.
578 There is no general guarantee that a URL, which at one time
579 located a given resource, will continue to do so. Nor is there any
580 guarantee that a URL will not locate a different resource at some
581 later point in time; such a guarantee can only be
582 obtained from the person(s) controlling that namespace and the
583 resource in question.
584 .PP
585 It is sometimes possible to construct a URL such that an attempt to
586 perform a seemingly harmless operation, such as the
587 retrieval of an entity associated with the resource, will in fact
588 cause a possibly damaging remote operation to occur. The unsafe URL
589 is typically constructed by specifying a port number other than that
590 reserved for the network protocol in question. The client
591 unwittingly contacts a site that is in fact running a different
592 protocol. The content of the URL contains instructions that, when
593 interpreted according to this other protocol, cause an unexpected
594 operation. An example has been the use of a gopher URL to cause an
595 unintended or impersonating message to be sent via a SMTP server.
596 .PP
597 Caution should be used when using any URL that specifies a port
598 number other than the default for the protocol, especially when it is
599 a number within the reserved space.
600 .PP
601 Care should be taken when a URI contains escaped delimiters for a
602 given protocol (for example, CR and LF characters for telnet
603 protocols) that these are not unescaped before transmission. This
604 might violate the protocol, but avoids the potential for such
605 characters to be used to simulate an extra operation or parameter in
606 that protocol, which might lead to an unexpected and possibly harmful
607 remote operation to be performed.
608 .PP
609 It is clearly unwise to use a URI that contains a password which is
610 intended to be secret. In particular, the use of a password within
611 the 'userinfo' component of a URI is strongly recommended against except
612 in those rare cases where the 'password' parameter is intended to be public.
613 .SH "CONFORMING TO"
614 .PP
615 .UR http://www.ietf.org/rfc/rfc2396.txt
616 IETF RFC 2396,
617 .UE
618 .UR http://www.w3.org/TR/REC-html40
619 HTML 4.0.
620 .UE
621 .SH BUGS
622 .PP
623 Documentation may be placed in a variety of locations, so there
624 currently isn't a good URI scheme for general online documentation
625 in arbitrary formats.
626 References of the form
627 <file:///usr/doc/ZZZ> don't work because different distributions and
628 local installation requirements may place the files in different
629 directories
630 (it may be in /usr/doc, or /usr/local/doc, or /usr/share, or somewhere else).
631 Also, the directory ZZZ usually changes when a version changes
632 (though filename globbing could partially overcome this).
633 Finally, using the file: scheme doesn't easily support people who dynamically
634 load documentation from the Internet (instead of loading the files
635 onto a local filesystem).
636 A future URI scheme may be added (e.g., "userdoc:") to permit
637 programs to include cross-references to more detailed documentation without
638 having to know the exact location of that documentation.
639 Alternatively, a future version of the filesystem specification may
640 specify file locations sufficiently so that the file: scheme will
641 be able to locate documentation.
642 .PP
643 Many programs and file formats don't include a way to incorporate
644 or implement links using URIs.
645 .PP
646 Many programs can't handle all of these different URI formats; there
647 should be a standard mechanism to load an arbitrary URI that automatically
648 detects the users' environment (e.g., text or graphics, desktop environment,
649 local user preferences, and currently-executing tools) and invokes the
650 right tool for any URI.
651 .SH AUTHOR
652 David A. Wheeler (dwheeler@dwheeler.com) wrote this man page.
653 .SH "SEE ALSO"
654 .BR lynx (1),
655 .BR man2html (1),
656 .BR mailaddr (7),
657 .BR utf-8 (7)
658 .UR http://www.ietf.org/rfc/rfc2255.txt
659 IETF RFC 2255.
660 .UE