RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-26 05:27:46 +00:00
Code Issues Activity Actions

LaunchServer: Only consider path in OpenURL

Browse source 
This resolves the crash in #6812 where the browser was trying to open a
file in the Download directory, but the check against allowed paths was
also trying to match the URL fragment.

Resolves #6812
This commit is contained in:
Valtteri Koskivuori 2021-05-02 16:41:01 +03:00 • committed by Andreas Kling
parent b7fb12338c
commit 5b6f36dfea
1 changed files with 3 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Userland/Services/LaunchServer/ClientConnection.cpp
View file

@ -36,9 +36,11 @@ Messages::LaunchServer::OpenURLResponse ClientConnection::handle(const Messages:
{
if (!m_allowlist.is_empty()) {
bool allowed = false;
auto request_url_without_fragment = request.url();
request_url_without_fragment.set_fragment({});
for (auto& allowed_handler : m_allowlist) {
if (allowed_handler.handler_name == request.handler_name()
&& (allowed_handler.any_url || allowed_handler.urls.contains_slow(request.url()))) {
&& (allowed_handler.any_url || allowed_handler.urls.contains_slow(request_url_without_fragment))) {
allowed = true;
break;
}