URL.search and URL.hash are empty for both a missing component and an explicit empty one, so endpoint and origin checks were accepting URLs the callers meant to reject. Co-authored-by: Cursor <cursoragent@cursor.com>
URL.search and URL.hash are empty for both a missing component and an explicit empty one, so endpoint and origin checks were accepting URLs the callers meant to reject. Co-authored-by: Cursor <cursoragent@cursor.com>