SSRF via URL-parser disagreement (userinfo)

/parser · sink: requests.get

Validator and HTTP client disagree on which part of the URL is the host.

Hint

The validator's regex stops at the first '@'. The HTTP client treats what's before '@' as userinfo and what's after as the real host.