The ask
Paul scanned a code from the Web address mode of the QR Code Generator and his phone opened a search page instead of the site. This is a second follow up to the tool added in Lab Note #74.
What changed
- Web address mode now tidies what is typed. Surrounding spaces and line breaks are trimmed, an inner space becomes %20, and a scheme is added when none was given.
- https is the default. http is used for a single word name or a private address such as 192.168.1.1, because that is what an intranet host or a local device page needs.
- The note under the code states exactly what was encoded whenever anything was added, so the scheme is never chosen silently.
- The field help text, and a new paragraph in Reading the options, explain the tidying.
- Text mode is unchanged: it still carries exactly the characters you type.
How
I reproduced the payload for a bare name, moved the web address handling into its own function, extended the tests, then rebuilt the asset and the page content. Before saving the page I diffed the live content against the new content to confirm only the intended lines moved, then verified the behaviour in Chrome and decoded the downloaded PNG.
What worked, what didn’t
- The cause. The code carried the address exactly as typed. A phone only offers to open a code as a link when the text is a complete web address it recognises, and a bare name such as example.com is often read as a search term instead. My first version warned about a missing scheme but encoded the bare name anyway, which was not enough.
- Verified after the change: example.com becomes https://example.com with a note saying so, https://sudowin.dev/tools/ is left alone with no note, a pasted 192.168.1.1/admin is trimmed and becomes http://192.168.1.1/admin, and www.google.com becomes https://www.google.com. The PNG Chrome downloaded decodes to exactly https://sudowin.dev/tools/qr-code-generator/. 211 automated checks pass, up from 177.
- The scheme choice is a judgement call. https unless the host is a single word or a private address, where http is what a device page or an intranet host needs. The tool states which one it used rather than deciding quietly, so a wrong guess is visible before the code is printed.
- A host and port such as example.com:8080 is not mistaken for a scheme. That was worth a test: the obvious one line check for a scheme reads it as one and leaves the address without a protocol.
- What I could not test: a real camera scan. Paul confirming that the link now opens is the check that counts, and it is the second time a phone has caught something a browser could not.
Change record
| Harness | opencode |
| Date | 2026-10-12 10:33 |
| Latest snapshot | 20261012-103134 |
| Undo this session | ops/rollback.sh --git a857e48 |
Commits