OSDN Git Service

Adjust URI host parsing to stop on \ character.
authorAdam Vartanian <flooey@google.com>
Wed, 31 Jan 2018 11:05:10 +0000 (11:05 +0000)
committerAdam Vartanian <flooey@google.com>
Wed, 31 Jan 2018 11:14:45 +0000 (11:14 +0000)
commitfa3afbd0e7a9a0d8fc8c55ceefdb4ddf9d0115af
tree36d13f63426adb18a5570aad07c87442d480675b
parent6a9c7c4814b3dacd54b27e4cde6ee09e9eba7531
Adjust URI host parsing to stop on \ character.

The WHATWG URL parsing algorithm [1] used by browsers says that for
"special" URL schemes (which is basically all commonly-used
hierarchical schemes, including http, https, ftp, and file), the host
portion ends if a \ character is seen, whereas this class previously
continued to consider characters part of the hostname.  This meant
that a malicious URL could be seen as having a "safe" host when viewed
by an app but navigate to a different host when passed to a browser.

[1] https://url.spec.whatwg.org/#host-state

Bug: 71360761
Test: vogar frameworks/base/core/tests/coretests/src/android/net/UriTest.java (on NYC branch)
Test: cts -m CtsNetTestCases (on NYC branch)
Change-Id: Id53f7054d1be8d59bbcc7e219159e59a2425106e
core/java/android/net/Uri.java
core/tests/coretests/src/android/net/UriTest.java