RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-14 08:24:58 +00:00
Code Issues Activity Actions

LibWebView: Fix sanitizing about scheme URLs

Browse source
This commit is contained in:
Bastiaan van der Plaat 2024-01-12 19:41:53 +01:00 • committed by Tim Flynn
parent cde14901bc
commit 63c6eae918
2 changed files with 18 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

17
Tests/LibWebView/TestWebViewURL.cpp
View file

@ -79,3 +79,20 @@ TEST_CASE(http_url)
compare_url_parts("http://abc.def.com#anchor"sv, { "http://abc."sv, "def.com"sv, "#anchor"sv }); compare_url_parts("http://abc.def.com#anchor"sv, { "http://abc."sv, "def.com"sv, "#anchor"sv });
compare_url_parts("http://abc.def.com?query"sv, { "http://abc."sv, "def.com"sv, "?query"sv }); compare_url_parts("http://abc.def.com?query"sv, { "http://abc."sv, "def.com"sv, "?query"sv });
} }
TEST_CASE(about_url)
{
auto is_sanitized_url_the_same = [](StringView url) {
auto sanitized_url = WebView::sanitize_url(url);
if (!sanitized_url.has_value())
return false;
return sanitized_url->to_string().value() == url;
};
EXPECT(!is_sanitized_url_the_same("about"sv));
EXPECT(!is_sanitized_url_the_same("about blabla:"sv));
EXPECT(!is_sanitized_url_the_same("blabla about:"sv));
EXPECT(is_sanitized_url_the_same("about:about"sv));
EXPECT(is_sanitized_url_the_same("about:version"sv));
}

2
Userland/Libraries/LibWebView/URL.cpp
View file

@ -35,7 +35,7 @@ static Optional<URL> create_url_with_url_or_path(String const& url_or_path)
static Optional<URL> query_public_suffix_list(StringView url_string) static Optional<URL> query_public_suffix_list(StringView url_string)
{ {
auto out = MUST(String::from_utf8(url_string)); auto out = MUST(String::from_utf8(url_string));
if (!out.contains("://"sv)) if (!out.starts_with_bytes("about:"sv) && !out.contains("://"sv))
out = MUST(String::formatted("https://{}"sv, out)); out = MUST(String::formatted("https://{}"sv, out));
auto maybe_url = create_url_with_url_or_path(out); auto maybe_url = create_url_with_url_or_path(out);