URI共通構文（7）

   A URI does not in itself pose a security threat.  Users should beware
   that there is no general guarantee that a URL, which at one time
   located a given resource, will continue to do so.  Nor is there any
   guarantee that a URL will not locate a different resource at some
   later point in time, due to the lack of any constraint on how a given
   authority apportions its namespace.  Such a guarantee can only be
   obtained from the person(s) controlling that namespace and the
   resource in question.  A specific URI scheme may include additional
   semantics, such as name persistence, if those semantics are required
   of all naming authorities for that scheme.

   It is sometimes possible to construct a URL such that an attempt to
   perform a seemingly harmless, idempotent operation, such as the
   retrieval of an entity associated with the resource, will in fact
   cause a possibly damaging remote operation to occur.  The unsafe URL
   is typically constructed by specifying a port number other than that
   reserved for the network protocol in question.  The client
   unwittingly contacts a site that is in fact running a different
   protocol.  The content of the URL contains instructions that, when
   interpreted according to this other protocol, cause an unexpected
   operation.  An example has been the use of a gopher URL to cause an
   unintended or impersonating message to be sent via a SMTP server.

   Caution should be used when using any URL that specifies a port
   number other than the default for the protocol, especially when it is
   a number within the reserved space.

   Care should be taken when a URL contains escaped delimiters for a
   given protocol (for example, CR and LF characters for telnet
   protocols) that these are not unescaped before transmission.  This
   might violate the protocol, but avoids the potential for such
   characters to be used to simulate an extra operation or parameter in
   that protocol, which might lead to an unexpected and possibly harmful
   remote operation to be performed.

   It is clearly unwise to use a URL that contains a password which is
   intended to be secret. In particular, the use of a password within
   the 'userinfo' component of a URL is strongly disrecommended except
   in those rare cases where the 'password' parameter is intended to be
   public.