URI Infrastructure

The foundation starts with URLs. Every API call constructs a URL from user input, and that’s where injection attacks live. We built RFC-compliant URI infrastructure that makes injection structurally impossible.

RFC 3986 URI Parsing

Complete implementation of URI parsing with RFC 3987 IRI support for internationalized identifiers. The parser handles the full grammar: scheme, authority, userinfo, host (IPv4, IPv6, IPvFuture), port, path, query, and fragment—with proper percent-encoding normalization. Strict validation throws on invalid input. No silent failures, no malformed-but-accepted URIs.

RFC 6570 URI Templates

All eight expansion operators across four expression levels: simple string, reserved, fragment, label, path segments, path parameters, form-style query, and form-style query continuation. Templates pre-compile for efficient repeated expansion with different variable values.

Hygienic URL Construction

URI Templates provide structural safety. User input cannot escape its designated position—a path parameter stays in the path, a query value stays quoted in the query string. The template grammar makes injection impossible by construction rather than by sanitization. No string concatenation with user input, no attack surface from URL manipulation.

Network Address Validation

Comprehensive validation for IPv6 (all compression forms, mixed IPv4-in-IPv6, exact hextet count), IPv4 (0-255 range, no leading zeros), and port numbers (0-65535 with overflow detection). Ambiguous or malformed addresses are rejected.

Reference Resolution

RFC 3986 §5.3 reference resolution with proper path merging, dot segment removal, and fragment handling. Correctly collapses ../ sequences and handles all relative reference types—prerequisite for resolving JSON References across documents.