Safari location pollution vulnerability and repair

Location is contaminated due to browser parsing of some protocol errors. when safari opens an http url with username/password, it will keep the account password in the address, because safari will decode the username part of the url when obtaining the location Value, in this way, we can control the username part to pollute the latter part. safari access http://www.qq.com % 2f@mmme.me/<script> alert (location = 'HTTP: // www.qq.com/@mmme.me/') </script>Solution:The username/password part is not decoded.