What version of Go are you using (go version)?

1.18 though tip

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

n/a

What did you do?

https://go.dev/play/p/63z_YnaE4vw?v=gotip

package main

import (
	"fmt"
	"net/url"
)

func main() {
	// https://twitter.com/bagder/status/1567162794092404742
	ickyUrl := `http://http://http://@http://http://?http://#http://`
	u, _ := url.Parse(ickyUrl)
	fmt.Printf("User: %v\n", u.User)
	fmt.Printf("Path: %v\n", u.Path)
}

What did you expect to see?

(this should be sanity checked, i might be reading things wrong)

User: http://http:// 
Path: http://http://

What did you see instead?

User: 
Path: //http://@http://http://

I noticed some more talk about what is correct later on: https://twitter.com/mtrantalainen/status/1567187061202878465

This is quirky enough it's not clear what the safe (not necessarily correct) thing should be. Perhaps nothing.