Bug 1812060 - Strip certain whitespace from protocol setters r=emilio…

…,necko-reviewers,valentin Strip tabs, new lines, and carriage returns from the input given to protocol setters for Location, URL, and Link. Also updated WPT expectations. Reference: whatwg/url#609 Differential Revision: https://phabricator.services.mozilla.com/D170404
jamienicol · Feb 22, 2023 · 3894bdc · 3894bdc
1 parent e967bbb
commit 3894bdc
Show file tree

Hide file tree

Showing 4 changed files with 9 additions and 25 deletions.
diff --git a/netwerk/base/nsSimpleURI.cpp b/netwerk/base/nsSimpleURI.cpp
@@ -297,9 +297,12 @@ nsSimpleURI::GetScheme(nsACString& result) {
   return NS_OK;
 }
 
-nsresult nsSimpleURI::SetScheme(const nsACString& scheme) {
-  const nsPromiseFlatCString& flat = PromiseFlatCString(scheme);
-  if (!net_IsValidScheme(flat)) {
+nsresult nsSimpleURI::SetScheme(const nsACString& input) {
+  // Strip tabs, newlines, carriage returns from input
+  nsAutoCString scheme(input);
+  scheme.StripTaggedASCII(ASCIIMask::MaskCRLFTab());
+
+  if (!net_IsValidScheme(scheme)) {
     NS_WARNING("the given url scheme contains invalid characters");
     return NS_ERROR_MALFORMED_URI;
   }

diff --git a/netwerk/base/nsStandardURL.cpp b/netwerk/base/nsStandardURL.cpp
@@ -1729,7 +1729,9 @@ nsresult nsStandardURL::SetSpecWithEncoding(const nsACString& input,
 }
 
 nsresult nsStandardURL::SetScheme(const nsACString& input) {
-  const nsPromiseFlatCString& scheme = PromiseFlatCString(input);
+  // Strip tabs, newlines, carriage returns from input
+  nsAutoCString scheme(input);
+  scheme.StripTaggedASCII(ASCIIMask::MaskCRLFTab());
 
   LOG(("nsStandardURL::SetScheme [scheme=%s]\n", scheme.get()));
 

diff --git a/...ta/html/browsers/history/the-location-interface/location-protocol-setter-sameish.html.ini b/...ta/html/browsers/history/the-location-interface/location-protocol-setter-sameish.html.ini
diff --git a/testing/web-platform/meta/url/url-setters.any.js.ini b/testing/web-platform/meta/url/url-setters.any.js.ini
@@ -744,12 +744,6 @@
   [URL: Setting <data:space ?query>.search = '' Drop trailing spaces from trailing opaque paths]
     expected: FAIL
 
-  [URL: Setting <http://test/>.protocol = 'h\r\ntt\tps' Tab and newline are stripped]
-    expected: FAIL
-
-  [URL: Setting <http://test/>.protocol = 'https\r']
-    expected: FAIL
-
 
 [url-setters.any.html?include=file]
   [URL: Setting <file:///test>.protocol = 'https']
@@ -1008,12 +1002,6 @@
   [URL: Setting <data:space ?query>.search = '' Drop trailing spaces from trailing opaque paths]
     expected: FAIL
 
-  [URL: Setting <http://test/>.protocol = 'h\r\ntt\tps' Tab and newline are stripped]
-    expected: FAIL
-
-  [URL: Setting <http://test/>.protocol = 'https\r']
-    expected: FAIL
-
 
 [url-setters.any.worker.html?include=file]
   [URL: Setting <file:///test>.protocol = 'https']