reject trailing bytes after IPv6 host literal in parse_url (#2536)

httplib.h

@@ -851,6 +851,15 @@ inline bool parse_url(const std::string &url, UrlComponents &uc) {
       }
 
       pos = close + 1;
+
+      // The IPv6 literal is the whole host, so ']' must be followed by a port,
+      // path, query or fragment delimiter (or the end of input). Otherwise the
+      // trailing bytes would be folded into the path while the connection
+      // still targets the bracketed address.
+      if (pos < url.size() && url[pos] != ':' && url[pos] != '/' &&
+          url[pos] != '?' && url[pos] != '#') {
+        return false;
+      }
     } else {
       auto end = url.find_first_of(":/?#", pos);
       if (end == std::string::npos) { end = url.size(); }