summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAdam Vartanian <flooey@google.com>2018-01-31 11:05:10 +0000
committerTim Schumacher <timschumi@gmx.de>2018-04-06 16:26:17 +0200
commitbffbc485c5558748e811ef6f0cc6e974b9fe9dd3 (patch)
tree8518fe22d9a49f637751637915d15c8e7f13a901
parenta5fe577fb0a7134fed74005dbac546f9b490dba4 (diff)
downloadframeworks_base-bffbc485c5558748e811ef6f0cc6e974b9fe9dd3.tar.gz
frameworks_base-bffbc485c5558748e811ef6f0cc6e974b9fe9dd3.tar.bz2
frameworks_base-bffbc485c5558748e811ef6f0cc6e974b9fe9dd3.zip
Adjust URI host parsing to stop on \ character.
The WHATWG URL parsing algorithm [1] used by browsers says that for "special" URL schemes (which is basically all commonly-used hierarchical schemes, including http, https, ftp, and file), the host portion ends if a \ character is seen, whereas this class previously continued to consider characters part of the hostname. This meant that a malicious URL could be seen as having a "safe" host when viewed by an app but navigate to a different host when passed to a browser. [1] https://url.spec.whatwg.org/#host-state Bug: 71360761 Test: vogar frameworks/base/core/tests/coretests/src/android/net/UriTest.java (on NYC branch) Test: cts -m CtsNetTestCases (on NYC branch) Change-Id: Id53f7054d1be8d59bbcc7e219159e59a2425106e (cherry picked from commit fa3afbd0e7a9a0d8fc8c55ceefdb4ddf9d0115af)
-rw-r--r--core/java/android/net/Uri.java8
-rw-r--r--core/tests/coretests/src/android/net/UriTest.java6
2 files changed, 14 insertions, 0 deletions
diff --git a/core/java/android/net/Uri.java b/core/java/android/net/Uri.java
index 06bb07b7629..d73c883c4ad 100644
--- a/core/java/android/net/Uri.java
+++ b/core/java/android/net/Uri.java
@@ -719,6 +719,10 @@ public abstract class Uri implements Parcelable, Comparable<Uri> {
LOOP: while (end < length) {
switch (uriString.charAt(end)) {
case '/': // Start of path
+ case '\\':// Start of path
+ // Per http://url.spec.whatwg.org/#host-state, the \ character
+ // is treated as if it were a / character when encountered in a
+ // host
case '?': // Start of query
case '#': // Start of fragment
break LOOP;
@@ -757,6 +761,10 @@ public abstract class Uri implements Parcelable, Comparable<Uri> {
case '#': // Start of fragment
return ""; // Empty path.
case '/': // Start of path!
+ case '\\':// Start of path!
+ // Per http://url.spec.whatwg.org/#host-state, the \ character
+ // is treated as if it were a / character when encountered in a
+ // host
break LOOP;
}
pathStart++;
diff --git a/core/tests/coretests/src/android/net/UriTest.java b/core/tests/coretests/src/android/net/UriTest.java
index 27b7f9e185b..ea0347d67ad 100644
--- a/core/tests/coretests/src/android/net/UriTest.java
+++ b/core/tests/coretests/src/android/net/UriTest.java
@@ -192,6 +192,12 @@ public class UriTest extends TestCase {
assertEquals("a:a@example.com:a@example2.com", uri.getAuthority());
assertEquals("example2.com", uri.getHost());
assertEquals(-1, uri.getPort());
+ assertEquals("/path", uri.getPath());
+
+ uri = Uri.parse("http://a.foo.com\\.example.com/path");
+ assertEquals("a.foo.com", uri.getHost());
+ assertEquals(-1, uri.getPort());
+ assertEquals("\\.example.com/path", uri.getPath());
}
@SmallTest