Looking at the linked URL parser, why doesn't it look like

  url = do scheme
           authority
           path
           query
           fragment
  where
  scheme = ...
  authority = ...
  etc.

Is there a common source of extra \r in malformed inputs, beyond those existing as part of \r\n? Or is this just a dig at Windows-style line endings? If there's something weird going on I think I'd rather fail loudly.

> Bounding the inner scanner to a single line makes “run past the end of a malformed line” unrepresentable rather than merely unlikely.

I don't really see what makes it "unrepresentable", and this reads more like "if you used the right scanning logic, you can't have used the wrong scanning logic".

One common way to test it is just to pass ipv6 url: http://[f021:d981:b487:e57d:193e:550e::]/

https://github.com/rust-bakery/nom