OSDN Git Service

Adjust URI host parsing to stop on \ character.
authorAdam Vartanian <flooey@google.com>
Wed, 31 Jan 2018 11:05:10 +0000 (11:05 +0000)
committerJP Sugarbroad <jpsugar@google.com>
Tue, 13 Feb 2018 21:57:06 +0000 (13:57 -0800)
commite8807a2b449b18bea555899f5aba9ba7f349d6e2
tree0cf9a821421034190b28c3688ef716b6a99a5b9a
parent69438cd3c9e10adeb6a08663b9c209c1d0de1085
Adjust URI host parsing to stop on \ character.

The WHATWG URL parsing algorithm [1] used by browsers says that for
"special" URL schemes (which is basically all commonly-used
hierarchical schemes, including http, https, ftp, and file), the host
portion ends if a \ character is seen, whereas this class previously
continued to consider characters part of the hostname.  This meant
that a malicious URL could be seen as having a "safe" host when viewed
by an app but navigate to a different host when passed to a browser.

[1] https://url.spec.whatwg.org/#host-state

Bug: 71360761
Test: vogar frameworks/base/core/tests/coretests/src/android/net/UriTest.java (on NYC branch)
Test: cts -m CtsNetTestCases (on NYC branch)
Change-Id: Id53f7054d1be8d59bbcc7e219159e59a2425106e
(cherry picked from commit fa3afbd0e7a9a0d8fc8c55ceefdb4ddf9d0115af)
core/java/android/net/Uri.java
core/tests/coretests/src/android/net/UriTest.java