Bug 1812060 - Strip certain whitespace from protocol setters r=emilio…

…,necko-reviewers,valentin Strip tabs, new lines, and carriage returns from the input given to protocol setters for Location, URL, and Link. Also updated WPT expectations. Reference: whatwg/url#609 Differential Revision: https://phabricator.services.mozilla.com/D170404
mozilla · Feb 23, 2023 · 06a86d7 · 06a86d7
1 parent 19ff48f
commit 06a86d7
Show file tree

Hide file tree

Showing 6 changed files with 9 additions and 109 deletions.
diff --git a/netwerk/base/nsSimpleURI.cpp b/netwerk/base/nsSimpleURI.cpp
@@ -297,9 +297,12 @@ nsSimpleURI::GetScheme(nsACString& result) {
   return NS_OK;
 }
 
-nsresult nsSimpleURI::SetScheme(const nsACString& scheme) {
-  const nsPromiseFlatCString& flat = PromiseFlatCString(scheme);
-  if (!net_IsValidScheme(flat)) {
+nsresult nsSimpleURI::SetScheme(const nsACString& input) {
+  // Strip tabs, newlines, carriage returns from input
+  nsAutoCString scheme(input);
+  scheme.StripTaggedASCII(ASCIIMask::MaskCRLFTab());
+
+  if (!net_IsValidScheme(scheme)) {
     NS_WARNING("the given url scheme contains invalid characters");
     return NS_ERROR_MALFORMED_URI;
   }

diff --git a/netwerk/base/nsStandardURL.cpp b/netwerk/base/nsStandardURL.cpp
@@ -1729,7 +1729,9 @@ nsresult nsStandardURL::SetSpecWithEncoding(const nsACString& input,
 }
 
 nsresult nsStandardURL::SetScheme(const nsACString& input) {
-  const nsPromiseFlatCString& scheme = PromiseFlatCString(input);
+  // Strip tabs, newlines, carriage returns from input
+  nsAutoCString scheme(input);
+  scheme.StripTaggedASCII(ASCIIMask::MaskCRLFTab());
 
   LOG(("nsStandardURL::SetScheme [scheme=%s]\n", scheme.get()));
 

diff --git a/...ta/html/browsers/history/the-location-interface/location-protocol-setter-sameish.html.ini b/...ta/html/browsers/history/the-location-interface/location-protocol-setter-sameish.html.ini
diff --git a/testing/web-platform/meta/url/url-setters-a-area.window.js.ini b/testing/web-platform/meta/url/url-setters-a-area.window.js.ini
@@ -1099,18 +1099,6 @@
   [<a>: Setting <sc:/nospace>.pathname = 'space ']
     expected: FAIL
 
-  [<a>: Setting <http://test/>.protocol = 'h\r\ntt\tps' Tab and newline are stripped]
-    expected: FAIL
-
-  [<area>: Setting <http://test/>.protocol = 'h\r\ntt\tps' Tab and newline are stripped]
-    expected: FAIL
-
-  [<a>: Setting <http://test/>.protocol = 'https\r']
-    expected: FAIL
-
-  [<area>: Setting <http://test/>.protocol = 'https\r']
-    expected: FAIL
-
 
 [url-setters-a-area.window.html?include=javascript]
   [<a>: Setting <javascript://x/>.username = 'wario']

diff --git a/testing/web-platform/meta/url/url-setters-stripping.any.js.ini b/testing/web-platform/meta/url/url-setters-stripping.any.js.ini
@@ -43,9 +43,6 @@
   [Setting hostname with middle U+0009 (https:)]
     expected: FAIL
 
-  [Setting protocol with leading U+0009 (https:)]
-    expected: FAIL
-
   [Setting port with middle U+0009 (https:)]
     expected: FAIL
 
@@ -82,9 +79,6 @@
   [Setting pathname with middle U+0009 (wpt++:)]
     expected: FAIL
 
-  [Setting protocol with leading U+000A (https:)]
-    expected: FAIL
-
   [Setting port with middle U+000A (wpt++:)]
     expected: FAIL
 
@@ -148,9 +142,6 @@
   [Setting pathname with trailing U+0009 (https:)]
     expected: FAIL
 
-  [Setting protocol with U+0009 before inserted colon (https:)]
-    expected: FAIL
-
   [Setting username with leading U+000D (wpt++:)]
     expected: FAIL
 
@@ -181,9 +172,6 @@
   [Setting password with leading U+0000 (wpt++:)]
     expected: FAIL
 
-  [Setting protocol with leading U+000D (https:)]
-    expected: FAIL
-
   [Setting port with leading U+000D (wpt++:)]
     expected: FAIL
 
@@ -214,9 +202,6 @@
   [Setting pathname with leading U+000D (https:)]
     expected: FAIL
 
-  [Setting protocol with U+0009 before inserted colon (wpt++:)]
-    expected: FAIL
-
   [Setting hostname with middle U+0009 (wpt++:)]
     expected: FAIL
 
@@ -286,9 +271,6 @@
   [Setting host with trailing U+0009 (https:)]
     expected: FAIL
 
-  [Setting protocol with U+000D before inserted colon (https:)]
-    expected: FAIL
-
   [Setting hostname with leading U+0009 (wpt++:)]
     expected: FAIL
 
@@ -319,9 +301,6 @@
   [Setting port with trailing U+0000 (wpt++:)]
     expected: FAIL
 
-  [Setting protocol with U+000D before inserted colon (wpt++:)]
-    expected: FAIL
-
   [Setting port with leading U+000A (wpt++:)]
     expected: FAIL
 
@@ -334,9 +313,6 @@
   [Setting host with trailing U+000D (https:)]
     expected: FAIL
 
-  [Setting protocol with leading U+000D (wpt++:)]
-    expected: FAIL
-
   [Setting port with leading U+0000 (https:)]
     expected: FAIL
 
@@ -397,15 +373,6 @@
   [Setting host with trailing U+000A (wpt++:)]
     expected: FAIL
 
-  [Setting protocol with U+000A before inserted colon (https:)]
-    expected: FAIL
-
-  [Setting protocol with U+000A before inserted colon (wpt++:)]
-    expected: FAIL
-
-  [Setting protocol with leading U+000A (wpt++:)]
-    expected: FAIL
-
   [Setting password with middle U+001F (wpt++:)]
     expected: FAIL
 
@@ -457,9 +424,6 @@
   [Setting hostname with leading U+001F (wpt++:)]
     expected: FAIL
 
-  [Setting protocol with leading U+0009 (wpt++:)]
-    expected: FAIL
-
   [Setting port with leading U+001F (wpt++:)]
     expected: FAIL
 
@@ -509,9 +473,6 @@
   [Setting hostname with middle U+0009 (https:)]
     expected: FAIL
 
-  [Setting protocol with leading U+0009 (https:)]
-    expected: FAIL
-
   [Setting port with middle U+0009 (https:)]
     expected: FAIL
 
@@ -548,9 +509,6 @@
   [Setting pathname with middle U+0009 (wpt++:)]
     expected: FAIL
 
-  [Setting protocol with leading U+000A (https:)]
-    expected: FAIL
-
   [Setting port with middle U+000A (wpt++:)]
     expected: FAIL
 
@@ -614,9 +572,6 @@
   [Setting pathname with trailing U+0009 (https:)]
     expected: FAIL
 
-  [Setting protocol with U+0009 before inserted colon (https:)]
-    expected: FAIL
-
   [Setting username with leading U+000D (wpt++:)]
     expected: FAIL
 
@@ -647,9 +602,6 @@
   [Setting password with leading U+0000 (wpt++:)]
     expected: FAIL
 
-  [Setting protocol with leading U+000D (https:)]
-    expected: FAIL
-
   [Setting port with leading U+000D (wpt++:)]
     expected: FAIL
 
@@ -680,9 +632,6 @@
   [Setting pathname with leading U+000D (https:)]
     expected: FAIL
 
-  [Setting protocol with U+0009 before inserted colon (wpt++:)]
-    expected: FAIL
-
   [Setting hostname with middle U+0009 (wpt++:)]
     expected: FAIL
 
@@ -752,9 +701,6 @@
   [Setting host with trailing U+0009 (https:)]
     expected: FAIL
 
-  [Setting protocol with U+000D before inserted colon (https:)]
-    expected: FAIL
-
   [Setting hostname with leading U+0009 (wpt++:)]
     expected: FAIL
 
@@ -785,9 +731,6 @@
   [Setting port with trailing U+0000 (wpt++:)]
     expected: FAIL
 
-  [Setting protocol with U+000D before inserted colon (wpt++:)]
-    expected: FAIL
-
   [Setting port with leading U+000A (wpt++:)]
     expected: FAIL
 
@@ -800,9 +743,6 @@
   [Setting host with trailing U+000D (https:)]
     expected: FAIL
 
-  [Setting protocol with leading U+000D (wpt++:)]
-    expected: FAIL
-
   [Setting port with leading U+0000 (https:)]
     expected: FAIL
 
@@ -863,15 +803,6 @@
   [Setting host with trailing U+000A (wpt++:)]
     expected: FAIL
 
-  [Setting protocol with U+000A before inserted colon (https:)]
-    expected: FAIL
-
-  [Setting protocol with U+000A before inserted colon (wpt++:)]
-    expected: FAIL
-
-  [Setting protocol with leading U+000A (wpt++:)]
-    expected: FAIL
-
   [Setting password with middle U+001F (wpt++:)]
     expected: FAIL
 
@@ -923,8 +854,5 @@
   [Setting hostname with leading U+001F (wpt++:)]
     expected: FAIL
 
-  [Setting protocol with leading U+0009 (wpt++:)]
-    expected: FAIL
-
   [Setting port with leading U+001F (wpt++:)]
     expected: FAIL
diff --git a/testing/web-platform/meta/url/url-setters.any.js.ini b/testing/web-platform/meta/url/url-setters.any.js.ini
@@ -744,12 +744,6 @@
   [URL: Setting <data:space ?query>.search = '' Drop trailing spaces from trailing opaque paths]
     expected: FAIL
 
-  [URL: Setting <http://test/>.protocol = 'h\r\ntt\tps' Tab and newline are stripped]
-    expected: FAIL
-
-  [URL: Setting <http://test/>.protocol = 'https\r']
-    expected: FAIL
-
 
 [url-setters.any.html?include=file]
   [URL: Setting <file:///test>.protocol = 'https']
@@ -1008,12 +1002,6 @@
   [URL: Setting <data:space ?query>.search = '' Drop trailing spaces from trailing opaque paths]
     expected: FAIL
 
-  [URL: Setting <http://test/>.protocol = 'h\r\ntt\tps' Tab and newline are stripped]
-    expected: FAIL
-
-  [URL: Setting <http://test/>.protocol = 'https\r']
-    expected: FAIL
-
 
 [url-setters.any.worker.html?include=file]
   [URL: Setting <file:///test>.protocol = 'https']